Web Security

The fundamental concepts behind HTTP.

Attacking a site by directly modifying the HTML.

Viewing information which is intended to be hidden.

Performing actions that are meant to be restricted by client-side checks.

A social network with missing server-side authorization on friend request endpoints.

Exploiting poor authentication mechanisms to impersonate other users.

Use brute force to guess weak authentication tokens.

Exploit missing authorization checks to win at an online game.

An interactive demo for experimenting with XSS.

Trigger XSS on a simple website.

Exploit XSS in a real multi-user application.

An interactive demo for experimenting with SQL injection.

Use SQL injection to access user accounts and passwords.

Use static analysis to find vulnerabilities which are difficult to discover otherwise.