Hands-on interactive guides for understanding how modern web attacks work — and how to defend against them.
Each module covers theory, attack mechanics, live demos, and defenses — all in one page.
Client-side injection that lets attackers execute arbitrary scripts in victims' browsers. Covers Reflected, Stored, DOM-Based, Blind, and Self-XSS — plus 3 hands-on interactive labs.
The most comprehensive interactive guide to Insecure Direct Object Reference vulnerabilities. Master the concepts with 10 ultra-visual labs, study real-world breaches, and learn battle-tested prevention techniques.
Manipulate database queries to extract, modify, or delete data. Union-based, blind, error-based, and second-order SQLi.
Force authenticated users to perform unintended actions. Token protection, SameSite cookies, and bypass techniques.
Trick servers into requesting internal resources. Cloud metadata endpoints, DNS rebinding, and port scanning.
Execute arbitrary code on the server. Command injection, insecure deserialization, template injection.
Include arbitrary files via path traversal, log poisoning, and PHP wrapper chains.
Exploit XML parsers to read files, perform SSRF, and exfiltrate data. In-band and out-of-band techniques.
Every vulnerability page is structured to take you from zero to confident.
Clear, plain-English explanations of what the vulnerability is, why it exists, and how attackers discover it.
Interactive sandboxed labs where you try the attack yourself in a safe, controlled environment — no setup needed.
Practical mitigation techniques with real code examples — so you can write secure applications from day one.