Explore Lessons
Interactive lessons covering the most common web security vulnerabilities.
Broken Access Control
- All resources on your site need to have access control implemented, even if they aren't intended to be discoverable by a user.
Buffer Overflows
- An attacker can use buffer overflows to take your site offline or to inject malicious code
Command Execution
- If your application calls out to the OS, you need to be sure command strings are securely constructed.
Cross-Site Request Forgery
- If an attacker can forge HTTP requests to your site, they may be able to trick your users into triggering unintended actions.
Directory Traversal
- Ensure file paths are safely interpreted, or hackers can access sensitive files on your server.
File Upload Vulnerabilities
- File uploads are an easy way for an attacker to inject malicious code into your application.
Password Mismanagement
- Safe treatment of passwords is essential to a secure authentication system - yet many websites get this wrong.
Privilege Escalation
- Privilege escalation occurs when an attacker exploits a vulnerability to impersonate another user or gain extra permissions.
Regex Injection
- Regular expressions are frequently used in web-development, but can be abused by attackers.
SQL Injection
- If you are vulnerable to SQL Injection, attackers can run arbitrary commands against your database.
Unencrypted Communication
- Insufficient encryption can make you vulnerable to monster-in-the-middle attacks.
User Enumeration
- Leaking username information on your site makes things much easier for hackers.
DOM-based XSS
- If you make use of URI fragments in your site, you need to ensure they cannot be abused to inject malicious JavaScript.
Reflected XSS
- When building a website, you need to be sure you do not accidentally create a channel that allows malicious JavaScript to be bounced off your server.
Cross-Site Scripting
- If your site allows users to add content, you need to be sure that attackers cannot inject malicious JavaScript.