RedSec
38 lessons

Web security

How modern web apps work and where common security assumptions fail.

  1. 001 Browser to server request flow Learn Browser to server request flow through a safe, repeatable web security workflow. intro tutorial 20 min
  2. 002 Forms and server-side validation Learn Forms and server-side validation through a safe, repeatable web security workflow. intro tutorial 20 min
  3. 003 Cookies, sessions, and attributes Learn Cookies, sessions, and attributes through a safe, repeatable web security workflow. intro tutorial 20 min
  4. 004 File upload review Learn File upload review through a safe, repeatable web security workflow. intro tutorial 20 min
  5. 005 Server-side request forgery concepts Learn Server-side request forgery concepts through a safe, repeatable web security workflow. intro tutorial 20 min
  6. 006 Open redirects and URL parsing Learn Open redirects and URL parsing through a safe, repeatable web security workflow. intro tutorial 20 min
  7. 007 Template rendering risks Learn Template rendering risks through a safe, repeatable web security workflow. intro reference 12 min
  8. 008 Caching and sensitive data Learn Caching and sensitive data through a safe, repeatable web security workflow. intro tutorial 20 min
  9. 009 Error handling and information leaks Learn Error handling and information leaks through a safe, repeatable web security workflow. core lab 30 min
  10. 010 Web app attack surface mapping Learn Web app attack surface mapping through a safe, repeatable web security workflow. core tutorial 20 min
  11. 011 HTTP method confusion Learn HTTP method confusion through a safe, repeatable web security workflow. core tutorial 20 min
  12. 012 Host header validation Learn Host header validation through a safe, repeatable web security workflow. core tutorial 20 min
  13. 013 Request smuggling concepts Learn Request smuggling concepts through a safe, repeatable web security workflow. core tutorial 20 min
  14. 014 SSRF allowlist bypass patterns Learn SSRF allowlist bypass patterns through a safe, repeatable web security workflow. core reference 12 min
  15. 015 URL parser confusion Learn URL parser confusion through a safe, repeatable web security workflow. core tutorial 20 min
  16. 016 File upload extension checks Learn File upload extension checks through a safe, repeatable web security workflow. core tutorial 20 min
  17. 017 File upload content type checks Learn File upload content type checks through a safe, repeatable web security workflow. core tutorial 20 min
  18. 018 Image processing attack surface Learn Image processing attack surface through a safe, repeatable web security workflow. core lab 30 min
  19. 019 Path normalization bugs Learn Path normalization bugs through a safe, repeatable web security workflow. core tutorial 20 min
  20. 020 Directory traversal testing Learn Directory traversal testing through a safe, repeatable web security workflow. core tutorial 20 min
  21. 021 Local file inclusion concepts Learn Local file inclusion concepts through a safe, repeatable web security workflow. core reference 12 min
  22. 022 Remote file inclusion concepts Learn Remote file inclusion concepts through a safe, repeatable web security workflow. core tutorial 20 min
  23. 023 Server side template injection workflow Learn Server side template injection workflow through a safe, repeatable web security workflow. core tutorial 20 min
  24. 024 Insecure deserialization in web apps Learn Insecure deserialization in web apps through a safe, repeatable web security workflow. core tutorial 20 min
  25. 025 Cache poisoning concepts Learn Cache poisoning concepts through a safe, repeatable web security workflow. core tutorial 20 min
  26. 026 Web cache deception Learn Web cache deception through a safe, repeatable web security workflow. advanced tutorial 35 min
  27. 027 Race conditions in web flows Learn Race conditions in web flows through a safe, repeatable web security workflow. advanced lab 45 min
  28. 028 Business logic payment flaws Learn Business logic payment flaws through a safe, repeatable web security workflow. advanced reference 12 min
  29. 029 Coupon and discount abuse cases Learn Coupon and discount abuse cases through a safe, repeatable web security workflow. advanced tutorial 35 min
  30. 030 Email change workflow review Learn Email change workflow review through a safe, repeatable web security workflow. advanced tutorial 35 min
  31. 031 Password change workflow review Learn Password change workflow review through a safe, repeatable web security workflow. advanced tutorial 35 min
  32. 032 Export and download endpoint review Learn Export and download endpoint review through a safe, repeatable web security workflow. advanced tutorial 35 min
  33. 033 Search endpoint review Learn Search endpoint review through a safe, repeatable web security workflow. advanced tutorial 35 min
  34. 034 Admin panel discovery in labs Learn Admin panel discovery in labs through a safe, repeatable web security workflow. advanced tutorial 35 min
  35. 035 Error based debugging signals Learn Error based debugging signals through a safe, repeatable web security workflow. advanced reference 12 min
  36. 036 Security headers review Learn Security headers review through a safe, repeatable web security workflow. advanced lab 45 min
  37. 037 Content sniffing risks Learn Content sniffing risks through a safe, repeatable web security workflow. advanced tutorial 35 min
  38. 038 Clickjacking review workflow Learn Clickjacking review workflow through a safe, repeatable web security workflow. advanced tutorial 35 min