Web Application Exploitation & Attack Vectors

Welcome to Module 2: Authentication & Session Exploitation. In this section of the curriculum, learners dive deep into foundational and advanced principles designed for production application. This module covers: Identify default vendor passwords, detect user enumeration via response timing/status codes, and bypass login rate limits with header spoofing.; Exploit flawed JWT implementations: algorithm None attacks, cracking HMAC-SHA256 secrets with hashcat, and JWT header manipulation.; Test password reset token predictability, host header injection in reset links, OAuth redirect_uri tampering, and duplicate account registration flaws..

Welcome to Module 3: Broken Access Control & IDOR. In this section of the curriculum, learners dive deep into foundational and advanced principles designed for production application. This module covers: Set up multi-user testing environments, identify object parameter references (IDs, UUIDs, filenames), and systematically exploit read/write IDOR flaws.; Escalate privileges vertically from standard user to administrator (role parameter tampering, hidden endpoints) and horizontally between peer tenants.; Bypass authorization through forced URL browsing, HTTP verb manipulation (GET to POST/PUT), and exploiting unprotected legacy API endpoints (v1 vs v2)..

Welcome to Module 4: Advanced Injection Attacks. In this section of the curriculum, learners dive deep into foundational and advanced principles designed for production application. This module covers: Detect manual SQL syntax errors, extract arbitrary database records using UNION SELECT, and confirm blind SQLi via boolean conditions and sleep payloads.; Identify context-specific XSS sinks (HTML, attribute, JavaScript), bypass WAF filters with event handlers, and escalate to session cookie theft.; Exploit system shell command concatenation (;, |, &&), exfiltrate data out-of-band via DNS/HTTP curl, and catch reverse shells on an external listener..

Welcome to Module 5: Modern API Security & Discovery. In this section of the curriculum, learners dive deep into foundational and advanced principles designed for production application. This module covers: Harvest hidden OpenAPI/Swagger specifications, test API token validation boundaries, and detect exposed production API keys in client-side code.; Inject unintended JSON properties (isAdmin, role) via Mass Assignment, intercept PII leaked in API responses, and test verb manipulation.; Dump the full schema using GraphQL introspection queries, test mutation authorization, execute batching bypasses, and trigger denial of service via circular query nesting..

Welcome to Module 6: Server-Side Exploitation & Infrastructure. In this section of the curriculum, learners dive deep into foundational and advanced principles designed for production application. This module covers: Bypass extension and Content-Type validation using double extensions, null bytes, and polyglot files to achieve Remote Code Execution via web shells.; Coerce servers into making internal network requests, bypass localhost filters via alternative IP encodings, and extract cloud instance credentials from AWS/GCP/Azure metadata.; Locate exposed environment files (.env, .git), exploit unauthenticated Spring Boot Actuator endpoints (/heapdump, /env), and test permissive CORS origins..

Welcome to Module 7: Business Logic Flaws & Financial Tampering. In this section of the curriculum, learners dive deep into foundational and advanced principles designed for production application. This module covers: Manipulate checkout prices, inject negative item quantities or currencies, and bypass tier limitations or coupon code restrictions.; Skip multi-step verification flows (payment, 2FA setup, approval gates) and exploit application race conditions using Turbo Intruder for double-spend attacks..