Path 05: How the Web Works — KashSec Academy

Requests, HTML/CSS/JS, client/server, cookies, APIs, DevTools. 18 free lessons, beginner level, starting with "The page-load journey"

Level: Beginner · 18 lessons · Free, no account needed.

Lessons in this path

  1. The page-load journey — Every step from click to rendered page.
  2. How browsers render pages — The DOM, the critical rendering path, and why this matters for XSS.
  3. HTML, CSS & JavaScript — Structure, style, behaviour — and why XSS exists.
  4. Client vs server — The single most important web-security idea.
  5. HTTP methods & status codes — GET vs POST, the 401-vs-403 distinction, and username enumeration.
  6. Cookies, sessions, logins — How you stay logged in — and how attackers steal that.
  7. Browser storage basics — localStorage, sessionStorage, and why tokens belong in HttpOnly cookies instead.
  8. Same-Origin Policy & CORS — The web's foundational trust boundary, and how it gets misconfigured.
  9. APIs & JSON — How modern apps really talk under the hood.
  10. WebSockets & the real-time web — Persistent, bidirectional connections for chat, live updates, and games.
  11. Browser DevTools — Your first hacking tool — free and built in.
  12. Web forms & input handling — Why client-side validation is a UX feature, never a security control.
  13. Content Security Policy basics — The browser-enforced header that blocks injected scripts from running at all.
  14. Anatomy of a web app — The full picture: client, server, DB, API, cookies.
  15. Web caching basics — CDNs, Cache-Control, and why caching sensitive pages is a real vulnerability.
  16. Web frameworks: an overview — React, Django, Express — and why framework defaults help but aren't magic.
  17. Cookies & Sessions Lab — Understand how authentication state is managed and attacked.
  18. Browser DevTools Lab — Learn to use your browser as a hacking tool.