Learn Hacking From the Best
Structured classes built by operators who ship real exploits. Preview the free lessons, then enrol to unlock the full curriculum.
Teach a classWeb Security Testing Essentials
The workflow every web pentest is built on: an intercepting proxy, mapping the attack surface, and turning a finding into a report.
SQL Injection
From a single quote to a full database dump: UNION attacks, blind boolean and time-based extraction, and how parameterised queries end the whole class.
Cross-Site Scripting (XSS)
Reflected, stored, and DOM-based XSS: how each is delivered, how to break out of every context, and why CSP plus output encoding is the real fix.
Cross-Site Request Forgery (CSRF)
Make a victim's browser send a state-changing request they never intended — and learn every way token, SameSite, and Referer defences are gotten wrong.
XML External Entity (XXE) Injection
Abuse XML parsers that resolve external entities to read local files, reach internal services (SSRF), and exfiltrate data blind through an external DTD.
API Testing
Recon undocumented APIs, test every method and parameter, and exploit the bugs APIs are prone to: mass assignment, BOLA/IDOR, and server-side parameter pollution.
Web Cache Deception
Trick a cache into storing another user's private, authenticated response by exploiting the gap between how the cache and the origin interpret a URL.
Web LLM Attacks
When an app wires an LLM to real tools and data, prompt injection becomes a path to other users' accounts, internal APIs, and stored XSS.