Security Code Review
Master vulnerability detection through interactive guides. Learn at your own pace with practical, code-focused lessons.
Cross-Site Scripting (XSS)
BeginnerLearn how to identify and prevent XSS vulnerabilities during code review
SQL Injection
IntermediateLearn to spot and prevent SQL injection vulnerabilities in your code
Command Injection
IntermediateMaster the art of identifying command injection vulnerabilities
NoSQL Injection
IntermediateIdentify injection flaws in MongoDB, Redis, and other NoSQL databases
LDAP Injection
AdvancedDetect and prevent LDAP injection in enterprise authentication systems
Server-Side Template Injection
AdvancedIdentify SSTI vulnerabilities in Jinja2, Twig, Freemarker, and more
HTTP Header Injection
IntermediateDetect CRLF injection and HTTP response splitting attacks
XPath Injection
IntermediateFind and prevent XPath injection in XML-based applications
Server-Side Request Forgery
IntermediateLearn to identify and prevent SSRF vulnerabilities through code review
Insecure File Upload
IntermediateLearn to identify and prevent dangerous file upload vulnerabilities
Path Traversal
IntermediateDetect directory traversal and local file inclusion vulnerabilities
XML External Entities (XXE)
IntermediateIdentify XXE vulnerabilities in XML parsers and document processing
Insecure Deserialization
AdvancedUnderstand and prevent object deserialization attacks
Business Logic Flaws
IntermediateIdentify logic vulnerabilities that bypass security controls
HTTP Request Smuggling
AdvancedDetect CL.TE, TE.CL, and TE.TE request smuggling vulnerabilities
JWT Security Vulnerabilities
IntermediateUnderstanding and preventing JSON Web Token security issues
Broken Authentication
IntermediateIdentify weak authentication patterns and session management flaws
IDOR & Access Control
IntermediateDetect insecure direct object references and authorization bypasses
OAuth 2.0 Security
AdvancedSecure OAuth implementations and prevent common misconfigurations
SAML Security
AdvancedIdentify SAML assertion vulnerabilities and SSO misconfigurations
Privilege Escalation
IntermediateDetect vertical and horizontal privilege escalation vulnerabilities
REST API Security
IntermediateSecure your REST APIs from common vulnerabilities and misconfigurations
GraphQL Security
IntermediateIdentify GraphQL-specific vulnerabilities and secure your schemas
WebSocket Security
IntermediateSecure real-time WebSocket communications and prevent hijacking
Rate Limiting & DoS Prevention
BeginnerImplement proper rate limiting and prevent denial of service
CORS Misconfiguration
IntermediateIdentify and fix Cross-Origin Resource Sharing security issues
API Versioning Security
BeginnerSecure API versioning and prevent legacy endpoint exploitation
gRPC Security
AdvancedSecure gRPC services and Protocol Buffer implementations
Secrets Management & Leakage
IntermediateDetecting and preventing sensitive data exposure in your codebase
Sensitive Data Exposure
IntermediateIdentify PII leaks, improper logging, and data handling issues
Cryptographic Failures
AdvancedDetect weak encryption, improper key management, and crypto misuse
Secure Logging Practices
BeginnerPrevent log injection and sensitive data exposure in logs
Data Masking & Anonymization
IntermediateImplement proper data masking for PII and sensitive information
Clickjacking & UI Redressing
BeginnerPrevent frame-based UI attacks and implement proper defenses
Prototype Pollution
AdvancedMaster JavaScript prototype pollution and its security implications
PostMessage Vulnerabilities
IntermediateSecure cross-origin communication and prevent message hijacking
CSP Bypass Techniques
AdvancedUnderstand Content Security Policy weaknesses and misconfigurations
Browser Storage Security
IntermediateSecure localStorage, sessionStorage, IndexedDB, and cookies
DOM Manipulation Attacks
IntermediatePrevent DOM clobbering, HTML injection, and DOM-based vulnerabilities
Supply Chain Security
AdvancedDetect malicious dependencies and secure your build pipeline
Subdomain Takeover
IntermediateDetect dangling DNS records and prevent subdomain hijacking
DNS Rebinding Attacks
AdvancedUnderstand and prevent DNS rebinding exploitation techniques
SSL/TLS Misconfiguration
IntermediateIdentify weak ciphers, certificate issues, and TLS vulnerabilities
Container Security
IntermediateSecure Docker images, Kubernetes configs, and container runtimes
Cloud Misconfiguration
IntermediateFind S3 bucket exposures, IAM issues, and cloud security flaws
CI/CD Pipeline Security
IntermediateSecure GitHub Actions, Jenkins, and deployment workflows
Race Conditions & TOCTOU
AdvancedIdentify timing vulnerabilities and race condition exploits
Web Cache Poisoning
AdvancedIdentify cache key manipulation and cache deception attacks
Second-Order Vulnerabilities
AdvancedFind stored payloads that trigger in different contexts
Parser Differentials
AdvancedExploit parsing inconsistencies between components
Polyglot Payloads
AdvancedCraft payloads that work across multiple contexts