Hack a Website
XSS, CSRF and SQL injection: learn to defend web applications
In the beginning...
Complete this course to earn XP
Lessons
Only hack with permission
Practice: Allowed or not?
Every request can be edited
Practice: Who controls it?
The OWASP Top 10
How SQL injection works
Practice: Get in without a password
Parameterised queries
Practice: Fix the query
Cross-site scripting
Stored and reflected XSS
Output encoding
Practice: Spot the unsafe lines
Content Security Policy
Practice: Write the policy
Cross-site request forgery
Practice: Does the cookie go?
Storing passwords
Rate limits and MFA
Broken access control
Practice: Allow or refuse?
Security headers and HTTPS
Practice: Match the header
Secrets in code
Test like a professional
Course Complete
Up nextRecommended first Launch Lesson
Break in to learn to defend
Learn how attackers exploit common web vulnerabilities and, more importantly, how to defend against them. Covers XSS, CSRF, SQL injection, and security headers.
