Practical application security laboratories covering server-side mechanisms, browser-rendered attack vectors, and advanced protocol desynchronization.
For complete beginners, we recommend starting with our server-side topics. These vulnerabilities are typically easier to learn because you only need to understand what's happening on the server. Our materials and labs will help you develop some of the core knowledge and skills that you will rely on time after time.
SQL injection is an old-but-gold vulnerability responsible for many high-profile data breaches. Although relatively simple to learn, it can potentially be used for some high-severity exploits. This makes it an ideal first topic for beginners, and essential knowledge even for more experienced users.
Vulnerabilities in authentication mechanisms can allow attackers to gain access to sensitive data and functionality. Learn how to identify and exploit flawed password resets, account lockouts, 2FA bypasses, and brute-force vulnerabilities.
Path traversal (also known as directory traversal) allows an attacker to read arbitrary files on the server that is running an application. This might include application code, data, and credentials for back-end systems.
OS command injection allows an attacker to execute arbitrary operating system commands on the server that is running an application, typically compromising the application and all its data.
Flaws in the design and implementation of applications that allow an attacker to elicit unintended behavior. This potentially enables attackers to manipulate legitimate functionality to achieve a malicious goal.
Information disclosure is when a website unintentionally reveals sensitive data to users. Depending on the context, this can leak sensitive credentials, financial details, or technical data that aids further attacks.
Access control security vulnerabilities occur when user-controlled data is passed to administrative functions, enabling horizontal and vertical privilege escalation, insecure direct object references (IDOR), and workflow bypasses.
Flaws where a web server allows users to upload files to its filesystem without sufficiently validating their name, type, contents, or size. Failing to enforce these restrictions can allow remote code execution.
Occur when websites process requests concurrently without adequate safeguards. A collision of requests can lead to multiple threads accessing the same resource simultaneously, resulting in unintended behavior.
SSRF allows an attacker to induce the server-side application to make HTTP requests to an arbitrary domain of the attacker's choosing, targeting internal systems, loopback adapters, and cloud metadata.
XML external entity injection is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data, enabling file viewing, SSRF, and blind data exfiltration.
Vulnerabilities that arise when an application includes user-supplied data in a NoSQL database query without proper sanitization, allowing attackers to manipulate queries and bypass access control.
Application programming interfaces (APIs) allow applications to communicate. Learn how to discover hidden API endpoints, identify broken object-level authorization, and exploit mass-assignment flaws.
An attack where a malicious actor tricks a web cache into storing sensitive, dynamic user responses, making them publicly accessible to unauthorized users.
Client-side vulnerabilities introduce an additional layer of complexity, which can make them slightly more challenging. These materials and labs will help you build on the server-side skills you've already learned and teach you how to identify and exploit some gnarly client-side vectors as well.
Simply put, XSS is one of the most important vulnerabilities out there. It's both incredibly common and extremely powerful, especially when used as part of a wider exploit chain. This is a huge topic, with plenty of labs for complete beginners and seasoned pros alike.
CSRF allows an attacker to induce users to perform actions that they do not intend to perform, circumventing the same-origin policy designed to prevent different websites from interfering with each other.
Browser mechanism that enables controlled access to resources located outside of a given domain. Misconfigured CORS policies can expose confidential user data to external attacker-controlled origins.
An interface-based attack where a user is tricked into clicking on actionable content on a hidden website by clicking on an invisible or transparent iframe overlaying an innocuous interface.
Vulnerabilities that arise when JavaScript takes data from an attacker-controllable source, such as the URL, and passes it to a sink that supports dynamic code execution or HTML rendering.
Persistent, bi-directional communication channels over a single TCP socket. Learn how to intercept, manipulate, and exploit security flaws across WebSocket handshakes and message streams.
These topics aren't necessarily more difficult to master but they generally require deeper understanding and a wider breadth of knowledge. We recommend getting to grips with the basics before tackling these labs, some of which are based on pioneering techniques discovered by our world-class research team.
Deserialization has a reputation for being difficult to get your head around but it can be much easier to exploit than you might think. We'll guide you through the process step-by-step so you can pick off some high-severity bugs that even experienced testers may have missed altogether.
Analyze vulnerabilities in web applications integrating Large Language Models. Exploit direct and indirect prompt injections, data leakage, and unauthorized function execution.
Vulnerabilities that arise from implementation and configuration errors in GraphQL APIs, enabling introspection abuse, circular nested queries, and authorization bypasses.
Occurs when user input is embedded directly into server templates rather than passed as data, allowing attackers to inject template directives and execute arbitrary code on the host.
Exploit subtle flaws in web servers and routing architecture so that harmful HTTP responses are saved in the cache and subsequently served to other users without authentication.
Exploit vulnerabilities where applications trust the HTTP Host header without validation, enabling web cache poisoning, password reset hijacking, and routing manipulation.
Desynchronize front-end and back-end HTTP socket streams by exploiting discrepancies in Content-Length and Transfer-Encoding headers, hijacking victim sessions and bypassing WAFs.
Flaws in how websites implement third-party OAuth authentication services, enabling attackers to harvest access tokens, hijack client accounts, and bypass verification checks.
Exploit JSON Web Token flaws including algorithm confusion, unverified signature validation, flawed key injection parameters, and weak HMAC secret keys.
Vulnerability that enables an attacker to add or overwrite arbitrary properties on JavaScript object prototypes, leading to client DOM XSS or server-side remote code execution.
Foundational reconnaissance mechanics, request manipulation techniques, and SolvinMe web security methodology required for efficient vulnerability analysis.
Unlike when you complete labs on the Web Security Academy, during the exam you'll have no prior knowledge of the type of vulnerability that you need to find and exploit. Use the mystery lab challenge below to spin up a randomized lab that you'll have to try and work out how to solve with no context, just like in the exam.