Tracks
Start with the first track even if you have some experience. Each track builds on the one before it.
Basics
What you need before any vulnerability: networks, HTTP, the browser, Linux and encoding.
Your progress in this track0%
Web security
The best-known web application vulnerabilities: how they work, how they are exploited and how they are fixed.
Your progress in this track0%
- XSS (Cross-Site Scripting)Beginner30 minCompleted
- SQL InjectionBeginner30 minCompleted
- IDOR (Insecure Direct Object Reference)Beginner20 minCompleted
- CSRF (Cross-Site Request Forgery)Intermediate25 minCompleted
- Path TraversalIntermediate20 minCompleted
- Command InjectionIntermediate25 minCompleted
- SSRF (Server-Side Request Forgery)Intermediate25 minCompleted
- JWT (JSON Web Tokens)Intermediate30 minCompleted
- File Upload vulnerabilitiesIntermediate25 minCompleted
- SSTI (Server-Side Template Injection)Intermediate25 minCompleted
- Authentication flawsIntermediate25 minCompleted
- XXE (XML External Entities)Intermediate25 minCompleted
- Open RedirectIntermediate20 minCompleted
- Security MisconfigurationBeginner20 minCompleted
- Business Logic FlawsIntermediate20 minCompleted
- GraphQL AbuseIntermediate25 minCompleted
- NoSQL InjectionIntermediate25 minCompleted
- Prototype PollutionIntermediate25 minCompleted
- Insecure DeserializationIntermediate25 minCompleted
- Rate Limiting FlawsIntermediate20 minCompleted
- Password Reset FlawsIntermediate20 minCompleted
- CORS MisconfigurationIntermediate20 minCompleted
- ClickjackingBeginner18 minCompleted
- HTTP Caching & Header FlawsIntermediate22 minCompleted
- Capstone: The Ravens' PanelIntermediate40 minCompleted
CTF challenges
The challenge types you meet in CTF competitions and how to think about solving them.
Your progress in this track0%