All learning materials - detailed

Web Security Academy Learning Paths
Race conditions
	Limit overrun race conditions
		Detecting and exploiting limit overrun race conditions with Burp Repeater
		Detecting and exploiting limit overrun race conditions with Turbo Intruder
	Hidden multi-step sequences
	Methodology
		1 - Predict potential collisions
		2 - Probe for clues
		3 - Prove the concept
	Multi-endpoint race conditions
		Aligning multi-endpoint race windows
	Connection warming
	Abusing rate or resource limits
	Single-endpoint race conditions
	Session-based locking mechanisms
	Partial construction race conditions
	Time-sensitive attacks
	How to prevent race condition vulnerabilities
		Predict a potential collision
		Benchmark the behavior
		Probe for clues
		Prove the concept
		Predict a potential collision
		Benchmark the behavior
		Probe for clues
		Prove the concept
		Predict a potential collision
		Benchmark the behavior
		Prove the concept
		Predict a potential collision
		Benchmark the behavior
		Probe for clues
		Prove the concept
		Predict a potential collision
		Benchmark the behavior
		Prove the concept
		Study the behavior
		Bypass the per-session locking restriction
		Confirm the vulnerability
GraphQL API vulnerabilities
	Finding GraphQL endpoints
		Universal queries
		Common endpoint names
		Request methods
		Initial testing
	Exploiting unsanitized arguments
	Discovering schema information
		Using introspection
		Probing for introspection
		Running a full introspection query
		Visualizing introspection results
		Suggestions
	Bypassing GraphQL introspection defenses
	Bypassing rate limiting using aliases
	GraphQL CSRF
		How do CSRF over GraphQL vulnerabilities arise?
	Preventing GraphQL attacks
		Preventing GraphQL brute force attacks
		Preventing CSRF over GraphQL
	What is GraphQL?
		How GraphQL works
		What is a GraphQL schema?
		What are GraphQL queries?
		What are GraphQL mutations?
		Components of queries and mutations
			Fields
			Arguments
			Variables
			Aliases
			Fragments
		Subscriptions
		Introspection
All topics
	Server-side topics
	Client-side topics
	Advanced topics
	Want the latest from the Web Security Academy?
Put your recon skills to the test
Getting started with the Web Security Academy
	How the Web Security Academy works
	Get started with your first topic
	Find your way around Burp Suite with our video tutorials
	Keep up with the latest from the Web Security Academy
What is prototype pollution?
	How do prototype pollution vulnerabilities arise?
	Prototype pollution sources
		Prototype pollution via the URL
		Prototype pollution via JSON input
	Prototype pollution sinks
	Prototype pollution gadgets
		Example of a prototype pollution gadget
	JavaScript prototypes and inheritance
		What is an object in JavaScript?
		What is a prototype in JavaScript?
		How does object inheritance work in JavaScript?
		The prototype chain
		Accessing an object's prototype using __proto__
		Modifying prototypes
	Client-side prototype pollution vulnerabilities
		Finding client-side prototype pollution sources manually
		Finding client-side prototype pollution sources using DOM Invader
		Finding client-side prototype pollution gadgets manually
		Finding client-side prototype pollution gadgets using DOM Invader
		Prototype pollution via the constructor
		Bypassing flawed key sanitization
		Prototype pollution in external libraries
		Prototype pollution via browser APIs
			Prototype pollution via fetch()
			Prototype pollution via Object.defineProperty()
	Server-side prototype pollution
		Why is server-side prototype pollution more difficult to detect?
		Detecting server-side prototype pollution via polluted property reflection
		Detecting server-side prototype pollution without polluted property reflection
			Status code override
			JSON spaces override
			Charset override
		Scanning for server-side prototype pollution sources
		Bypassing input filters for server-side prototype pollution
		Remote code execution via server-side prototype pollution
			Identifying a vulnerable request
			Remote code execution via child_process.fork()
			Remote code execution via child_process.execSync()
	Preventing prototype pollution vulnerabilities
		Sanitizing property keys
		Preventing changes to prototype objects
		Preventing an object from inheriting properties
		Using safer alternatives where possible
Essential skills
	Obfuscating attacks using encodings
	Using Burp Scanner during manual testing
	Identifying unknown vulnerabilities
	Obfuscating attacks using encodings
		Context-specific decoding
		Decoding discrepancies
		Obfuscation via URL encoding
		Obfuscation via double URL encoding
		Obfuscation via HTML encoding
			Leading zeros
		Obfuscation via XML encoding
		Obfuscation via unicode escaping
		Obfuscation via hex escaping
		Obfuscation via octal escaping
		Obfuscation via multiple encodings
		Obfuscation via the SQL CHAR() function
	Using Burp Scanner during manual testing
		Scanning a specific request
		Scanning custom insertion points
		Scanning non-standard data structures
SQL injection
	What is SQL injection (SQLi)?
	What is the impact of a successful SQL injection attack?
	How to detect SQL injection vulnerabilities
	SQL injection in different parts of the query
	SQL injection examples
	Retrieving hidden data
	Subverting application logic
	Retrieving data from other database tables
	Blind SQL injection vulnerabilities
	Second-order SQL injection
	Examining the database
	SQL injection in different contexts
	How to prevent SQL injection
	Examining the database in SQL injection attacks
		Querying the database type and version
		Listing the contents of the database
			Listing the contents of an Oracle database
	SQL injection UNION attacks
		Determining the number of columns required
		Database-specific syntax
		Finding columns with a useful data type
		Using a SQL injection UNION attack to retrieve interesting data
		Retrieving multiple values within a single column
	Blind SQL injection
		What is blind SQL injection?
		Exploiting blind SQL injection by triggering conditional responses
		Error-based SQL injection
			Exploiting blind SQL injection by triggering conditional errors
			Extracting sensitive data via verbose SQL error messages
		Exploiting blind SQL injection by triggering time delays
		Exploiting blind SQL injection using out-of-band (OAST) techniques
		How to prevent blind SQL injection attacks?
	SQL injection cheat sheet
		String concatenation
		Substring
		Comments
		Database version
		Database contents
		Conditional errors
		Extracting data via visible error messages
		Batched (or stacked) queries
		Time delays
		Conditional time delays
		DNS lookup
		DNS lookup with data exfiltration
Cross-site scripting
	What is cross-site scripting (XSS)?
	How does XSS work?
	XSS proof of concept
	What are the types of XSS attacks?
	Reflected cross-site scripting
	Stored cross-site scripting
	DOM-based cross-site scripting
	What can XSS be used for?
	Impact of XSS vulnerabilities
	How to find and test for XSS vulnerabilities
	Content security policy
	Dangling markup injection
	How to prevent XSS attacks
	Common questions about cross-site scripting
	Reflected XSS
		What is reflected cross-site scripting?
		Impact of reflected XSS attacks
		Reflected XSS in different contexts
		How to find and test for reflected XSS vulnerabilities
		Common questions about reflected cross-site scripting
	Stored XSS
		What is stored cross-site scripting?
		Impact of stored XSS attacks
		Stored XSS in different contexts
		How to find and test for stored XSS vulnerabilities
	DOM-based XSS
		What is DOM-based cross-site scripting?
		How to test for DOM-based cross-site scripting
			Testing HTML sinks
			Testing JavaScript execution sinks
			Testing for DOM XSS using DOM Invader
		Exploiting DOM XSS with different sources and sinks
			Sources and sinks in third-party dependencies
		DOM XSS in jQuery
		DOM XSS in AngularJS
		DOM XSS combined with reflected and stored data
		Which sinks can lead to DOM-XSS vulnerabilities?
		How to prevent DOM-XSS vulnerabilities
	Cross-site scripting contexts
		XSS between HTML tags
		XSS in HTML tag attributes
		XSS into JavaScript
			Terminating the existing script
			Breaking out of a JavaScript string
			Making use of HTML-encoding
			XSS in JavaScript template literals
		XSS via client-side template injection
		Client-side template injection
			What is client-side template injection?
			What is the AngularJS sandbox?
			How does the AngularJS sandbox work?
			How does an AngularJS sandbox escape work?
				Constructing an advanced AngularJS sandbox escape
			How does an AngularJS CSP bypass work?
				Bypassing a CSP with an AngularJS sandbox escape
			How to prevent client-side template injection vulnerabilities
	Exploiting cross-site scripting vulnerabilities
		Exploiting cross-site scripting to steal cookies
		Exploiting cross-site scripting to capture passwords
		Exploiting cross-site scripting to perform CSRF
	Dangling markup injection
		What is dangling markup injection?
		How to prevent dangling markup attacks
	Content security policy
		What is CSP (content security policy)?
		Mitigating XSS attacks using CSP
		Mitigating dangling markup attacks using CSP
		Bypassing CSP with policy injection
		Protecting against clickjacking using CSP
	How to prevent XSS
		Encode data on output
		Validate input on arrival
			Whitelisting vs blacklisting
		Allowing "safe" HTML
		How to prevent XSS using a template engine
		How to prevent XSS in PHP
		How to prevent XSS client-side in JavaScript
		How to prevent XSS in jQuery
		Mitigating XSS using content security policy (CSP)
	Cross-site scripting (XSS) cheat sheet
		Event handlers
			Event handlers that do not require user interaction
			Event handlers that do require user interaction
		Consuming tags
		File upload attacks
		Restricted characters
		Frameworks
		Protocols
		Other useful attributes
		Special tags
		Encoding
		Obfuscation
		Client-side template injection
			VueJS reflected
			AngularJS sandbox escapes reflected
			DOM based AngularJS sandbox escapes
			AngularJS CSP bypasses
		Scriptless attacks
			Dangling markup
		Polyglots
		WAF bypass global objects
		Content types
		Response content types
		Impossible labs
		Prototype pollution
		Classic vectors (XSS crypt)
Cross-site request forgery (CSRF)
	What is CSRF?
	What is the impact of a CSRF attack?
	How does CSRF work?
	How to construct a CSRF attack
	How to deliver a CSRF exploit
	Common defences against CSRF
	XSS vs CSRF
		What is the difference between XSS and CSRF?
		Can CSRF tokens prevent XSS attacks?
	Bypassing CSRF token validation
		What is a CSRF token?
		Common flaws in CSRF token validation
			Validation of CSRF token depends on request method
			Validation of CSRF token depends on token being present
			CSRF token is not tied to the user session
			CSRF token is tied to a non-session cookie
			CSRF token is simply duplicated in a cookie
	Bypassing SameSite cookie restrictions
		What is a site in the context of SameSite cookies?
		What's the difference between a site and an origin?
		How does SameSite work?
			Strict
			Lax
			None
		Bypassing SameSite Lax restrictions using GET requests
		Bypassing SameSite restrictions using on-site gadgets
		Bypassing SameSite restrictions via vulnerable sibling domains
		Bypassing SameSite Lax restrictions with newly issued cookies
	Bypassing Referer-based CSRF defenses
		Validation of Referer depends on header being present
		Validation of Referer can be circumvented
	How to prevent CSRF vulnerabilities
		Use CSRF tokens
			How should CSRF tokens be generated?
			How should CSRF tokens be transmitted?
			How should CSRF tokens be validated?
		Use Strict SameSite cookie restrictions
		Be wary of cross-origin, same-site attacks
XML external entity (XXE) injection
	What is XML external entity injection?
	How do XXE vulnerabilities arise?
	What are the types of XXE attacks?
	Exploiting XXE to retrieve files
	Exploiting XXE to perform SSRF attacks
	Blind XXE vulnerabilities
	Finding hidden attack surface for XXE injection
		XInclude attacks
		XXE attacks via file upload
		XXE attacks via modified content type
	How to find and test for XXE vulnerabilities
	How to prevent XXE vulnerabilities
	XML entities
		What is XML?
		What are XML entities?
		What is document type definition?
		What are XML custom entities?
		What are XML external entities?
	Finding and exploiting blind XXE vulnerabilities
		What is blind XXE?
		Detecting blind XXE using out-of-band (OAST) techniques
		Exploiting blind XXE to exfiltrate data out-of-band
		Exploiting blind XXE to retrieve data via error messages
		Exploiting blind XXE by repurposing a local DTD
			Locating an existing DTD file to repurpose
Clickjacking (UI redressing)
	What is clickjacking?
	How to construct a basic clickjacking attack
		Clickbandit
	Clickjacking with prefilled form input
	Frame busting scripts
	Combining clickjacking with a DOM XSS attack
	Multistep clickjacking
	How to prevent clickjacking attacks
		X-Frame-Options
		Content Security Policy (CSP)
Cross-origin resource sharing (CORS)
	What is CORS (cross-origin resource sharing)?
	Same-origin policy
	Relaxation of the same-origin policy
	Vulnerabilities arising from CORS configuration issues
		Server-generated ACAO header from client-specified Origin header
		Errors parsing Origin headers
		Whitelisted null origin value
		Exploiting XSS via CORS trust relationships
		Breaking TLS with poorly configured CORS
		Intranets and CORS without credentials
	How to prevent CORS-based attacks
		Proper configuration of cross-origin requests
		Only allow trusted sites
		Avoid whitelisting null
		Avoid wildcards in internal networks
		CORS is not a substitute for server-side security policies
	Same-origin policy (SOP)
		What is the same-origin policy?
		Why is the same-origin policy necessary?
		How is the same-origin policy implemented?
	CORS and the Access-Control-Allow-Origin response header
		What is the Access-Control-Allow-Origin response header?
		Implementing simple cross-origin resource sharing
		Handling cross-origin resource requests with credentials
		Relaxation of CORS specifications with wildcards
		Pre-flight checks
		Does CORS protect against CSRF?
Server-side request forgery (SSRF)
	What is SSRF?
	Labs
	What is the impact of SSRF attacks?
	Common SSRF attacks
		SSRF attacks against the server
		SSRF attacks against other back-end systems
	Circumventing common SSRF defenses
		SSRF with blacklist-based input filters
		SSRF with whitelist-based input filters
		Bypassing SSRF filters via open redirection
	Blind SSRF vulnerabilities
	Finding hidden attack surface for SSRF vulnerabilities
		Partial URLs in requests
		URLs within data formats
		SSRF via the Referer header
	Blind SSRF vulnerabilities
		What is blind SSRF?
		What is the impact of blind SSRF vulnerabilities?
		How to find and exploit blind SSRF vulnerabilities
HTTP request smuggling
	What is HTTP request smuggling?
	What happens in an HTTP request smuggling attack?
	How do HTTP request smuggling vulnerabilities arise?
	How to perform an HTTP request smuggling attack
		CL.TE vulnerabilities
		TE.CL vulnerabilities
		TE.TE behavior: obfuscating the TE header
	How to identify HTTP request smuggling vulnerabilities
	How to exploit HTTP request smuggling vulnerabilities
	Advanced HTTP request smuggling
	Browser-powered request smuggling
	How to prevent HTTP request smuggling vulnerabilities
	Finding HTTP request smuggling vulnerabilities
		Finding HTTP request smuggling vulnerabilities using timing techniques
			Finding CL.TE vulnerabilities using timing techniques
			Finding TE.CL vulnerabilities using timing techniques
		Confirming HTTP request smuggling vulnerabilities using differential responses
			Confirming CL.TE vulnerabilities using differential responses
			Confirming TE.CL vulnerabilities using differential responses
	Exploiting HTTP request smuggling vulnerabilities
		Using HTTP request smuggling to bypass front-end security controls
		Revealing front-end request rewriting
		Bypassing client authentication
		Capturing other users' requests
		Using HTTP request smuggling to exploit reflected XSS
		Using HTTP request smuggling to turn an on-site redirect into an open redirect
			Turning root-relative redirects into open redirects
		Using HTTP request smuggling to perform web cache poisoning
		Using HTTP request smuggling to perform web cache deception
	Advanced request smuggling
		HTTP/2 request smuggling
			HTTP/2 message length
			HTTP/2 downgrading
			H2.CL vulnerabilities
			H2.TE vulnerabilities
			Hidden HTTP/2 support
		Response queue poisoning
		Request smuggling via CRLF injection
		HTTP/2 request splitting
			Accounting for front-end rewriting
		HTTP request tunnelling
		HTTP/2-exclusive vectors
			Injecting via header names
			Injecting via pseudo-headers
				Supplying an ambiguous host
				Supplying an ambiguous path
				Injecting a full request line
				Injecting a URL prefix
				Injecting newlines into pseudo-headers
		Response queue poisoning
			What is the impact of response queue poisoning?
			How to construct a response queue poisoning attack
				Understanding the aftermath of request smuggling
				Smuggling a complete request
				Desynchronizing the response queue
				Stealing other users' responses
		HTTP request tunnelling
			Request tunnelling with HTTP/2
			Leaking internal headers via HTTP/2 request tunnelling
			Blind request tunnelling
			Non-blind request tunnelling using HEAD
			Web cache poisoning via HTTP/2 request tunnelling
		HTTP/2 downgrading
			What risks are associated with HTTP/2 downgrading?
	Browser-powered request smuggling
		CL.0 request smuggling
		Client-side desync attacks
		Pause-based desync attacks
		CL.0 request smuggling
			Testing for CL.0 vulnerabilities
			Eliciting CL.0 behavior
			Exploiting CL.0 vulnerabilities
			H2.0 vulnerabilities
			How to prevent CL.0 vulnerabilities
		Client-side desync attacks
			What is a client-side desync attack?
			Testing for client-side desync vulnerabilities
				Probing for client-side desync vectors
				Confirming the desync vector in Burp
				Building a proof of concept in a browser
				Handling redirects
			Exploiting client-side desync vulnerabilities
				Client-side variations of classic attacks
				Client-side cache poisoning
			Poisoning the cache with a redirect
			Triggering the resource import
			Delivering a payload
				Pivoting attacks against internal infrastructure
			How to prevent client-side desync vulnerabilities
		Pause-based desync attacks
			Server-side pause-based desync
				Testing for pause-based CL.0 vulnerabilities
			Client-side pause-based desync
			How to prevent pause-based desync vulnerabilities
OS command injection
	What is OS command injection?
	Injecting OS commands
	Useful commands
	Blind OS command injection vulnerabilities
		Detecting blind OS command injection using time delays
		Exploiting blind OS command injection by redirecting output
		Exploiting blind OS command injection using out-of-band (OAST) techniques
	Ways of injecting OS commands
	How to prevent OS command injection attacks
Server-side template injection
	What is server-side template injection?
	What is the impact of server-side template injection?
	How do server-side template injection vulnerabilities arise?
	Constructing a server-side template injection attack
		Detect
		Identify
		Exploit
	How to prevent server-side template injection vulnerabilities
	Exploiting server-side template injection vulnerabilities
		Read
			Learn the basic template syntax
			Read about the security implications
			Look for known exploits
		Explore
			Developer-supplied objects
		Create a custom attack
			Constructing a custom exploit using an object chain
			Constructing a custom exploit using developer-supplied objects
Insecure deserialization
	What is serialization?
		Serialization vs deserialization
	What is insecure deserialization?
	How do insecure deserialization vulnerabilities arise?
	What is the impact of insecure deserialization?
	How to exploit insecure deserialization vulnerabilities
	How to prevent insecure deserialization vulnerabilities
	Exploiting insecure deserialization vulnerabilities
		How to identify insecure deserialization
			PHP serialization format
			Java serialization format
		Manipulating serialized objects
			Modifying object attributes
			Modifying data types
		Using application functionality
		Magic methods
		Injecting arbitrary objects
		Gadget chains
			Working with pre-built gadget chains
			Working with documented gadget chains
		Creating your own exploit
		PHAR deserialization
		Exploiting deserialization using memory corruption
Path traversal
	What is path traversal?
	Reading arbitrary files via path traversal
	Common obstacles to exploiting path traversal vulnerabilities
	How to prevent a path traversal attack
Access control vulnerabilities and privilege escalation
	What is access control?
		Vertical access controls
		Horizontal access controls
		Context-dependent access controls
	Examples of broken access controls
		Vertical privilege escalation
	Unprotected functionality
	Parameter-based access control methods
	Broken access control resulting from platform misconfiguration
	Broken access control resulting from URL-matching discrepancies
		Horizontal privilege escalation
		Horizontal to vertical privilege escalation
		Insecure direct object references
		Access control vulnerabilities in multi-step processes
		Referer-based access control
		Location-based access control
	How to prevent access control vulnerabilities
	Insecure direct object references (IDOR)
		What are insecure direct object references (IDOR)?
		IDOR examples
			IDOR vulnerability with direct reference to database objects
			IDOR vulnerability with direct reference to static files
	Access control security models
		What are access control security models?
		Programmatic access control
		Discretionary access control (DAC)
		Mandatory access control (MAC)
		Role-based access control (RBAC)
Authentication vulnerabilities
	Labs
	What is authentication?
		What is the difference between authentication and authorization?
	How do authentication vulnerabilities arise?
	What is the impact of vulnerable authentication?
	Vulnerabilities in authentication mechanisms
		Vulnerabilities in third-party authentication mechanisms
	Preventing attacks on your own authentication mechanisms
	Vulnerabilities in password-based login
		Brute-force attacks
			Brute-forcing usernames
			Brute-forcing passwords
			Username enumeration
		Flawed brute-force protection
			Account locking
			User rate limiting
		HTTP basic authentication
	Vulnerabilities in multi-factor authentication
		Two-factor authentication tokens
		Bypassing two-factor authentication
		Flawed two-factor verification logic
		Brute-forcing 2FA verification codes
	Vulnerabilities in other authentication mechanisms
		Keeping users logged in
		Resetting user passwords
			Sending passwords by email
			Resetting passwords using a URL
		Changing user passwords
	How to secure your authentication mechanisms
		Take care with user credentials
		Don't count on users for security
		Prevent username enumeration
		Implement robust brute-force protection
		Triple-check your verification logic
		Don't forget supplementary functionality
		Implement proper multi-factor authentication
	Authentication lab usernames
	Authentication lab passwords
OAuth 2.0 authentication vulnerabilities
	What is OAuth?
	How does OAuth 2.0 work?
		OAuth authentication
	How do OAuth authentication vulnerabilities arise?
	Identifying OAuth authentication
	Recon
	Exploiting OAuth authentication vulnerabilities
		Vulnerabilities in the OAuth client application
	Improper implementation of the implicit grant type
	Flawed CSRF protection
		Leaking authorization codes and access tokens
		Flawed scope validation
		Unverified user registration
	Extending OAuth with OpenID Connect
	Preventing OAuth authentication vulnerabilities
	OAuth grant types
		What is an OAuth grant type?
		OAuth scopes
		Authorization code grant type
		Implicit grant type
	OpenID Connect
		What is OpenID Connect?
		How does OpenID Connect work?
			OpenID Connect roles
			OpenID Connect claims and scopes
			ID token
		Identifying OpenID Connect
		OpenID Connect vulnerabilities
			Unprotected dynamic client registration
			Allowing authorization requests by reference
	How to prevent OAuth authentication vulnerabilities
		For OAuth service providers
		For OAuth client applications
Business logic vulnerabilities
	What are business logic vulnerabilities?
	How do business logic vulnerabilities arise?
	What is the impact of business logic vulnerabilities?
	What are some examples of business logic vulnerabilities?
	How to prevent business logic vulnerabilities
	Examples of business logic vulnerabilities
		Excessive trust in client-side controls
		Failing to handle unconventional input
		Making flawed assumptions about user behavior
			Trusted users won't always remain trustworthy
			Users won't always supply mandatory input
			Users won't always follow the intended sequence
		Domain-specific flaws
		Providing an encryption oracle
Testing for WebSockets security vulnerabilities
	WebSockets
	Manipulating WebSocket traffic
		Intercepting and modifying WebSocket messages
		Replaying and generating new WebSocket messages
		Manipulating WebSocket connections
	WebSockets security vulnerabilities
		Manipulating WebSocket messages to exploit vulnerabilities
		Manipulating the WebSocket handshake to exploit vulnerabilities
		Using cross-site WebSockets to exploit vulnerabilities
	How to secure a WebSocket connection
	What are WebSockets?
		What is the difference between HTTP and WebSockets?
		How are WebSocket connections established?
		What do WebSocket messages look like?
	Cross-site WebSocket hijacking
		What is cross-site WebSocket hijacking?
		What is the impact of cross-site WebSocket hijacking?
		Performing a cross-site WebSocket hijacking attack
DOM-based vulnerabilities
	What is the DOM?
	Taint-flow vulnerabilities
		What is taint flow?
		Common sources
		Which sinks can lead to DOM-based vulnerabilities?
		How to prevent DOM-based taint-flow vulnerabilities
	DOM clobbering
	Controlling the web message source
		What is the impact of DOM-based web message vulnerabilities?
		How to construct an attack using web messages as the source
		Origin verification
		Which sinks can lead to DOM-based web message vulnerabilities?
	DOM-based open redirection
		What is DOM-based open redirection?
		What is the impact of DOM-based open redirection?
		Which sinks can lead to DOM-based open-redirection vulnerabilities?
		How to prevent DOM-based open-redirection vulnerabilities
	DOM-based cookie manipulation
		What is DOM-based cookie manipulation?
		What is the impact of a DOM-based cookie-manipulation attack?
		Which sinks can lead to DOM-based cookie-manipulation vulnerabilities?
		How to prevent DOM-based cookie-manipulation vulnerabilities
	DOM-based JavaScript injection
		What is DOM-based JavaScript injection?
		What is the impact of a DOM-based JavaScript-injection attack?
		Which sinks can lead to DOM-based JavaScript-injection vulnerabilities?
		How to prevent DOM-based JavaScript-injection vulnerabilities
	DOM-based document-domain manipulation
		What is DOM-based document-domain manipulation?
		Which sinks can lead to DOM-based document-domain manipulation vulnerabilities?
		How to prevent DOM-based document-domain manipulation vulnerabilities
	DOM-based WebSocket-URL poisoning
		What is DOM-based WebSocket-URL poisoning?
		What is the impact of WebSocket-URL poisoning?
		Which sinks can lead to WebSocket-URL poisoning vulnerabilities?
		How to prevent DOM-based WebSocket-URL poisoning vulnerabilities
	DOM-based link manipulation
		What is DOM-based link manipulation?
		What is the impact of a DOM-based link-manipulation attack?
		Which sinks can lead to DOM-based link-manipulation vulnerabilities?
		How to prevent DOM-based link-manipulation vulnerabilities
	Web message manipulation
		What is DOM-based web message manipulation?
		Which sinks can lead to DOM-based web-message manipulation vulnerabilities?
		How to prevent DOM-based web message manipulation
	DOM-based Ajax request-header manipulation
		What is DOM-based Ajax request-header manipulation?
		What is the impact of DOM-based Ajax request-header manipulation?
		Which sinks can lead to DOM-based Ajax request-header manipulation vulnerabilities?
		How to prevent DOM-based Ajax request-header manipulation
	DOM-based local file-path manipulation
		What is DOM-based local file-path manipulation?
		What is the impact of DOM-based local file-path manipulation?
		Which sinks can lead to DOM-based local file-path manipulation vulnerabilities?
		How to prevent DOM-based local file-path manipulation vulnerabilities
	DOM-based client-side SQL injection
		What is DOM-based client-side SQL injection?
		What is the impact of DOM-based client-side SQL injection?
		Which sinks can lead to DOM-based client-side SQL-injection vulnerabilities?
		How to prevent DOM-based client-side SQL-injection vulnerabilities
	DOM-based HTML5-storage manipulation
		What is DOM-based HTML5-storage manipulation?
		Which sinks can lead to DOM-based HTML5-storage manipulation vulnerabilities?
		How to prevent DOM-based HTML5-storage manipulation vulnerabilities
	DOM-based client-side XPath injection
		What is DOM-based XPath injection?
		What is the impact of DOM-based XPath injection?
		Which sinks can lead to XPath-injection vulnerabilities?
		How to prevent DOM-based XPath-injection vulnerabilities
	DOM-based client-side JSON injection
		What is DOM-based JSON injection?
		What is the impact of a DOM-based JSON-injection attack?
		Which sinks can lead to DOM-based JSON-injection vulnerabilities?
		How to prevent client-side JSON-injection vulnerabilities?
	DOM-data manipulation
		What is DOM-data manipulation?
		What is the impact of DOM-data manipulation?
		Which sinks can lead to DOM-data manipulation vulnerabilities?
		How to prevent DOM-data manipulation vulnerabilities
	DOM-based denial of service
		What is DOM-based denial of service?
		Which sinks can lead to DOM-based denial-of-service vulnerabilities?
		How to prevent DOM-based denial-of-service vulnerabilities
	DOM clobbering
		What is DOM clobbering?
		How to exploit DOM-clobbering vulnerabilities
		How to prevent DOM-clobbering attacks
Web cache poisoning
	What is web cache poisoning?
		Web cache poisoning research
		How does a web cache work?
	What is the impact of a web cache poisoning attack?
	Constructing a web cache poisoning attack
		Identify and evaluate unkeyed inputs
	Param Miner
		Elicit a harmful response from the back-end server
		Get the response cached
	Exploiting web cache poisoning vulnerabilities
	How to prevent web cache poisoning vulnerabilities
	Exploiting cache design flaws
		Using web cache poisoning to deliver an XSS attack
		Using web cache poisoning to exploit unsafe handling of resource imports
		Using web cache poisoning to exploit cookie-handling vulnerabilities
		Using multiple headers to exploit web cache poisoning vulnerabilities
		Exploiting responses that expose too much information
			Cache-control directives
			Vary header
		Using web cache poisoning to exploit DOM-based vulnerabilities
		Chaining web cache poisoning vulnerabilities
	Exploiting cache implementation flaws
		Cache key flaws
		Cache probing methodology
			Identify a suitable cache oracle
			Probe key handling
			Identify an exploitable gadget
		Exploiting cache key flaws
			Unkeyed port
			Unkeyed query string
			Unkeyed query parameters
			Cache parameter cloaking
			Normalized cache keys
			Cache key injection
		Poisoning internal caches
			How to identify internal caches
			Testing internal caches safely
HTTP Host header attacks
	What is the HTTP Host header?
	What is the purpose of the HTTP Host header?
		Virtual hosting
		Routing traffic via an intermediary
		How does the HTTP Host header solve this problem?
	What is an HTTP Host header attack?
	How do HTTP Host header vulnerabilities arise?
	Exploiting HTTP Host header vulnerabilities
	How to prevent HTTP Host header attacks
	How to identify and exploit HTTP Host header vulnerabilities
		How to test for vulnerabilities using the HTTP Host header
			Supply an arbitrary Host header
			Check for flawed validation
			Send ambiguous requests
			Inject host override headers
		How to exploit the HTTP Host header
			Password reset poisoning
			Web cache poisoning via the Host header
			Exploiting classic server-side vulnerabilities
			Accessing restricted functionality
			Accessing internal websites with virtual host brute-forcing
			Routing-based SSRF
			Connection state attacks
			SSRF via a malformed request line
		Password reset poisoning
			How does a password reset work?
			How to construct a password reset poisoning attack
Information disclosure vulnerabilities
	What is information disclosure?
		Examples of information disclosure
	How do information disclosure vulnerabilities arise?
	What is the impact of information disclosure vulnerabilities?
		How to assess the severity of information disclosure vulnerabilities
	Exploiting information disclosure
	How to prevent information disclosure vulnerabilities
	How to find and exploit information disclosure vulnerabilities
		How to test for information disclosure vulnerabilities
			Fuzzing
			Using Burp Scanner
			Using Burp's engagement tools
			Engineering informative responses
		Common sources of information disclosure
			Files for web crawlers
			Directory listings
			Developer comments
			Error messages
			Debugging data
			User account pages
			Source code disclosure via backup files
			Information disclosure due to insecure configuration
			Version control history
File upload vulnerabilities
	What are file upload vulnerabilities?
	What is the impact of file upload vulnerabilities?
	How do file upload vulnerabilities arise?
	How do web servers handle requests for static files?
	Exploiting unrestricted file uploads to deploy a web shell
	Exploiting flawed validation of file uploads
		Flawed file type validation
		Preventing file execution in user-accessible directories
		Insufficient blacklisting of dangerous file types
	Overriding the server configuration
	Obfuscating file extensions
		Flawed validation of the file's contents
		Exploiting file upload race conditions
	Race conditions in URL-based file uploads
	Exploiting file upload vulnerabilities without remote code execution
		Uploading malicious client-side scripts
		Exploiting vulnerabilities in the parsing of uploaded files
	Uploading files using PUT
	How to prevent file upload vulnerabilities
JWT attacks
	What are JWTs?
		JWT format
		JWT signature
		JWT vs JWS vs JWE
	What are JWT attacks?
	What is the impact of JWT attacks?
	How do vulnerabilities to JWT attacks arise?
	How to work with JWTs in Burp Suite
	Exploiting flawed JWT signature verification
		Accepting arbitrary signatures
		Accepting tokens with no signature
	Brute-forcing secret keys
		Brute-forcing secret keys using hashcat
	JWT header parameter injections
		Injecting self-signed JWTs via the jwk parameter
		Injecting self-signed JWTs via the jku parameter
		Injecting self-signed JWTs via the kid parameter
		Other interesting JWT header parameters
	JWT algorithm confusion
	How to prevent JWT attacks
		Additional best practice for JWT handling
	Algorithm confusion attacks
		Symmetric vs asymmetric algorithms
		How do algorithm confusion vulnerabilities arise?
		Performing an algorithm confusion attack
			Step 1 - Obtain the server's public key
			Step 2 - Convert the public key to a suitable format
			Step 3 - Modify your JWT
			Step 4 - Sign the JWT using the public key
		Deriving public keys from existing tokens
Guidelines for submitting video solutions
	What are the requirements for new video solutions?
Who is behind the Web Security Academy?
	Community contributions
	Inspiration from the community
Welcome back!
	Ready for your next challenge?
	Can we help you get started?
	Want the latest from the Web Security Academy?

Want to track your progress and have a more personalized learning experience? (It's free!)

All learning materials - detailed

Find vulnerabilities using Burp Suite