Explore Lessons
Interactive lessons covering the most common web security vulnerabilities.
- New
Slopsquatting (LLM Supply Chain)
- When LLM tools hallucinate package names, attackers can register malicious packages with those names.
- New
CSS Injection
- Attackers can manipulate user-generated CSS to extract sensitive data.
- New
Cross-Origin Resource Sharing
- Overly permissive CORS policies can allow malicious websites to access your APIs and steal user data.
- Rolling this out to a team?
Track who finished what, generate PCI DSS and ISO 27001 reports, and roll out to your whole team in an hour. Free trial, no credit card.
Misinformation and Model Poisoning in LLMs
- Machine learning is prone to bias and unreliability, and you need to put in safeguards to protect against that.
Sensitive Information Disclosure in LLMs
- Your machine learning model may be leaking sensitive data without you knowing it.
Prompt Injection in LLM Apps
- Prompt injection represents an easy way for an attacker to introduce unexpected behavior in a machine learning model.
Broken Access Control
- All resources on your site need to have access control implemented, even if they aren't intended to be discoverable by a user.
Buffer Overflows
- An attacker can use buffer overflows to take your site offline or to inject malicious code.
Clickjacking
- As an application author, you need to be sure your users aren't having their clicks stolen by attackers.
Command Execution
- If your application calls out to the OS, you need to be sure command strings are securely constructed.
Cross-Site Request Forgery
- If an attacker can forge HTTP requests to your site, they may be able to trick your users into triggering unintended actions.
Denial of Service Attacks
- Sometimes attackers don't need to hack your website, they just want to make it unavailable to others.
Directory Traversal
- Ensure file paths are safely interpreted, or hackers can access sensitive files on your server.
DNS Poisoning
- If upstream DNS caches have been poisoned, attackers may be intercepting traffic before it even gets to you.
Downgrade Attacks
- Attackers may be able to intercept, read and manipulate HTTPS traffic if you fail to specify a modern version of TLS.
Email Spoofing
- Email spoofing is the sending of email messages with a forged "from" address.
File Upload Vulnerabilities
- File uploads are an easy way for an attacker to inject malicious code into your application.
Host Header Poisoning
- It's dangerous to rely on the value supplied in the Host header of an HTTP request.
Information Leakage
- Revealing system information helps an attacker learn about your tech stack.
Insecure Design
- Security begins before you start writing code.
Lax Security Settings
- Improper security settings are a common cause of vulnerabilities.
Logging and Monitoring
- Comprehensive logging and monitoring will tell you what your site is doing at runtime, which is key to spotting security events.
Malvertising
- Embedded adverts are a common target for hackers.
Mass Assignment
- Automatically unpacking data from the HTTP request can sometimes be too easy.
Open Redirects
- Most web-applications make use of redirects. If your site forwards to URLs supplied in a query string, you could be enabling phishing attacks.
Password Mismanagement
- Safe treatment of passwords is essential to a secure authentication system - yet many websites get this wrong.
Privilege Escalation
- Privilege escalation occurs when an attacker exploits a vulnerability to impersonate another user or gain extra permissions.
Prototype Pollution
- If an attacker can access and modify prototype objects in JavaScript, you are in danger.
Regex Injection
- Regular expressions are frequently used in web-development, but can be abused by attackers.
Remote Code Execution
- If an attacker can smuggle code into your web-server process, you have a serious problem.
Session Fixation
- Insecure treatment of session IDs can leave your users vulnerable to having their session hijacked.
SQL Injection
- If you are vulnerable to SQL Injection, attackers can run arbitrary commands against your database.
SSL Stripping
- If only some actions on your website require HTTPS, an attacker may be able to steal credentials for your users.
Server-Side Request Forgery
- An attacker can use SSRF vulnerabilities to probe your internal network.
Subdomain Squatting
- Attackers will steal dangling subdomains to deliver malware and perform phishing attacks.
Toxic Dependencies
- Third-party libraries could be introducing vulnerabilities or malicious code into your system.
Unencrypted Communication
- Insufficient encryption can make you vulnerable to monster-in-the-middle attacks.
User Enumeration
- Leaking username information on your site makes things much easier for hackers.
Weak Session IDs
- Guessable session IDs make your website vulnerable to session hijacking.
XML Bombs
- Unsafe treatment of XML entities can make your server vulnerable to attack from specially crafted XML files.
XML External Entities
- Unsafe treatment of external references in XML allows an attacker to probe your file system for sensitive information.
DOM-based XSS
- If you make use of URI fragments in your site, you need to ensure they cannot be abused to inject malicious JavaScript.
Reflected XSS
- When building a website, you need to be sure you do not accidentally create a channel that allows malicious JavaScript to be bounced off your server.
Cross-Site Scripting
- If your site allows users to add content, you need to be sure that attackers cannot inject malicious JavaScript.
Cross-Site Script Inclusion
- If you are putting sensitive data in your JavaScript files, an attacker is probably stealing it.