Security Topics

Each topic hub pulls together everything for a vulnerability class — an interactive payload generator, a copy-ready cheat sheet, a step-by-step testing guide, and in-depth articles — so you can go from learning to testing in one place.

Cross-Site Scripting (XSS)Cross-site scripting lets an attacker run their JavaScript in another user's browser session — one of the most common and impactful web flaws.SQL Injection (SQLi)SQL injection lets an attacker alter the queries an application sends to its database — leading to data theft, authentication bypass, and sometimes full server compromise.Server-Side Request Forgery (SSRF)SSRF tricks a server into making HTTP requests on the attacker's behalf, reaching internal services and cloud metadata endpoints that aren't exposed to the internet.JWT AttacksJSON Web Tokens carry authentication state to the client, so flaws in how they're verified can let an attacker forge identities and escalate privileges.Server-Side Template Injection (SSTI)Server-side template injection happens when user input is evaluated as part of a template, often escalating from expression evaluation to full remote code execution.Command InjectionCommand injection lets an attacker run operating-system commands on the host by abusing input that an application passes to a shell.Insecure Direct Object References (IDOR)IDOR is an access-control flaw where changing an identifier in a request lets you read or modify objects that belong to other users.XML External Entity (XXE) InjectionXXE injection abuses an XML parser that resolves external entities, letting an attacker read local files, reach internal services, and exfiltrate data.

$loading...