Web Security Fundamentals
How real applications actually get compromised — SQL injection, XSS, CSRF, SSRF, and the rest of the OWASP Top 10 vulnerability classes, explained by the exact mechanism an attacker exploits, not just a checklist of things to avoid.
18 lessons
Beginner
Thinking like an attacker — trust boundaries and attack surfaceBeginner4 min read·Not startedSQL injection — how it happens, and why parameterized queries fix itBeginner4 min read·Not startedCross-Site Scripting (XSS) — the three types, and why escaping mattersBeginner4 min read·Not startedOpen redirects and their real exploitation chainsBeginner3 min read·Not started
Intermediate
Cross-Site Request Forgery (CSRF) — tricking a browser into acting for youIntermediate4 min read·Not startedSecurity headers — CSP, HSTS, and what each one actually blocksIntermediate4 min read·Not startedServer-Side Request Forgery (SSRF) — when the server becomes the attacker's proxyIntermediate4 min read·Not startedSecrets management — beyond just keeping keys out of gitIntermediate4 min read·Not startedDependency vulnerabilities and supply chain attacksIntermediate4 min read·Not startedRate limiting and brute-force protectionIntermediate4 min read·Not startedPath traversal and file upload vulnerabilitiesIntermediate3 min read·Not startedBroken access control — IDOR and the 'just check ownership' gapIntermediate4 min read·Not startedClickjacking and UI redressingIntermediate3 min read·Not startedEncryption basics for engineers — at rest, in transit, and what 'encrypted' doesn't meanIntermediate4 min read·Not started
Advanced
Insecure deserialization — why "just parse the data" can execute codeAdvanced4 min read·Not startedSecurity through the SDLC — threat modeling and secure code review basicsAdvanced4 min read·Not startedLogging, monitoring, and incident response fundamentalsAdvanced4 min read·Not startedCommon web security bugs and gotchas — a field referenceAdvanced3 min read·Not started