Learn / Level 3

Web vulnerabilities

The bug classes behind most real breaches, one per lesson, each tied to a real CVE.

1. 01Never trust inputThe root cause behind most of this level.9 min
2. 02Path traversalEscaping the folder you were meant to stay in.8 min
3. 03SQL injectionWhen data becomes a database command.8 min
4. 04Cross-site scriptingWhen a page runs code it should only have shown.8 min
5. 05OS command injectionWhen input reaches a shell.8 min
6. 06Server-side request forgeryMaking a server fetch what you could not.8 min
7. 07Unsafe deserializationRebuilding objects from untrusted bytes.8 min
8. 08File upload flawsWhen a profile photo is a program.9 min
9. 09Log4Shell and Spring4ShellWhen a library you never chose becomes your biggest hole.10 min