Path 11: Web Security & Hacking — KashSec Academy

OWASP Top 10, Burp, IDOR, XSS, SQLi, command injection, SSRF, JWT. 26 free lessons, intermediate level, starting with "The OWASP Top 10"

Level: Intermediate · 26 lessons · Free, no account needed.

Lessons in this path

  1. The OWASP Top 10 — The web hacker's shared checklist, in plain words.
  2. Burp Suite & PortSwigger — The professional's tool and free lab platform.
  3. Web recon — Subdomains, paths, parameters, JS files.
  4. Path Traversal Basics — Escaping an intended directory with ../, and the encoded bypasses that follow.
  5. Broken access & IDOR — The friendliest first bug — just change the ID.
  6. CSRF — Cross-Site Request Forgery — Tricking a browser into sending a request the victim never meant to send.
  7. Clickjacking — Invisible iframes, and why frame-ancestors matters.
  8. Cross-Site Scripting — Reflected, stored, DOM — and how to prove it safely.
  9. Web Security Headers: A Deep Dive — HSTS, X-Content-Type-Options, Referrer-Policy, and every header this course has mentioned, in one place.
  10. SQL Injection — The classic — with auth bypass, UNION, blind, sqlmap.
  11. Business Logic Vulnerabilities — Price tampering, step-skipping, and bugs no scanner will ever find.
  12. Race Conditions in Web Applications — The check-then-act flaw behind coupon replay and double-spend bugs.
  13. Command inj. & uploads — Two paths to server takeover.
  14. XXE — XML External Entity Injection — File disclosure, SSRF, and denial of service through XML parsing.
  15. Local & Remote File Inclusion (LFI/RFI) — When 'read this file' becomes 'execute this file.'
  16. Insecure Deserialization — Why pickle.load() on untrusted data can mean instant code execution.
  17. SSRF & auth attacks — Cloud metadata, JWT, credential attacks.
  18. API Security Fundamentals — Every vulnerability in this path, reshaped for JSON endpoints.
  19. GraphQL Security Basics — Introspection, query depth attacks, and why IDOR gets easier to find.
  20. Web Application Firewalls (WAFs) — Real protection, real limits, and why a WAF is never the actual fix.
  21. Secure Coding for Web Developers — Every defensive principle in this path, consolidated into one checklist.
  22. Your 90-day roadmap — A concrete plan to reach real bug bounty.
  23. Advanced Burp Suite Lab — Take your Burp skills to the next level.
  24. Advanced JWT Lab — Deep dive into JWT attacks and defenses.
  25. SSRF & JWT Lab — Practice two important modern web attacks.
  26. XSS Practical Lab — Learn to find and exploit Cross-Site Scripting safely.