Cybersecurity, learned like a practitioner.
24 learning paths · 398 modules live · every lesson written by someone who has shipped the control or run the engagement. Free to start.
Intermediate · modules
Modules tagged Intermediate. Use the sidebar to narrow by track or topic.
The Three Types of Web Sessions
“Session” is overloaded: browser session (open tabs), server session (data keyed by session ID), application session (the user’s logical workflow). Each has different lifetime; each has different invalidation rules. The bug pattern: developer thinks “user logged out, session ended.” Browser session ended. Server session may persist. JWT may still be valid. OAuth refresh token still […]
Why HTTP Headers Are Programmable Trust
Application code routinely trusts HTTP headers. X-Forwarded-For for client IP. Host for routing. Origin for CORS. Each is attacker-controllable in some path. If your code does if (request.headers["X-Admin-Override"] == "true"), you’ve created a backdoor. If your code trusts X-Forwarded-For without validating the immediate peer, you’ve created an IP-spoofing primitive. The mindset: each header your code […]
CDN as Attack Surface
CDN was once a passive cache. Now: edge functions, header rewriting, cache key manipulation, custom routing. Each is a new attack surface. Cache poisoning, cache deception, edge-function privilege escalation, header injection between CDN and origin — all bug classes that didn’t exist when CDN was just static-asset cache. The mindset: list every CDN feature you […]
Why Validation at Multiple Layers
Defence in depth is a phrase. Multi-layer validation is its application. Client-side validation catches user mistakes. Edge validation (WAF) catches bulk attacks. Server-side validation enforces business rules. Database constraints catch the rest. Each catches what the others miss. Skip a layer = bypass that layer’s coverage entirely. The mistake: assuming “the WAF catches it” or […]
The 5 Trust Boundaries in Every Web App
Trust boundaries are where one component trusts data from another. Each crossing is a place to validate. Most apps have at least 5: Browser to server (the obvious one — input validation) Server to database (parameterised queries) Server to upstream API (output validation, response-content trust) Server to cache (cache-key collisions, deserialisation) Server to message queue […]
Reading Other People’s Code With Suspicion
Most code review looks for “does it work?” Security code review asks “does it work for inputs the author didn’t imagine?” The questions: What does the author assume about input format? What language quirk could surprise this code? What if this is concurrent? What if the dependency does something unexpected? What if the user’s session […]
Every Protocol Has Trust Assumptions
Every protocol — DHCP, ARP, DNS, BGP, NTP, IP, TCP — was designed for an environment with assumed cooperation. Attackers violate those assumptions. DHCP: trust whoever responds first. ARP: trust whoever claims an IP. DNS: trust whoever answers a query. BGP: trust whoever announces a route. Each assumption is a poisoning attack vector when the […]
RAG Security
RAG combines vector search + LLM. Security model is hybrid. Threats specific to RAG Vector store data exposure — anyone with access reads embeddings (and retrieves originals) Indirect prompt injection via retrieved docs — adversary plants malicious doc; RAG retrieves and follows instructions IAM bypass via vector similarity — user query semantically matches private docs […]
AI Model Supply Chain
AI models are software you don’t see. Supply chain matters. Pickle deserialisation PyTorch models default to Python pickle format. Pickle = arbitrary code execution. Loading a malicious pickle = RCE. Defence: use SafeTensors format. Hugging Face migrated; PyTorch 2.6+ defaults to safer mode. Hugging Face hub trust Anyone can publish models. Imitating popular models with […]
AI Output Filtering
LLM outputs aren’t safe by default. Production systems filter. Filter categories PII redaction — outputs that mention real names, addresses, IDs Toxicity / harmful content — Perspective API, HuggingFace classifiers Hallucination detection — fact-checking against authoritative sources Code injection prevention — SQL, shell commands Prompt-leakage prevention — output containing system prompt Architecture pattern LLM generates […]
Practitioners who've
shipped the controls.
Every module is written by someone who has built the defence or run the engagement. No repackaged tutorials, no generic theory.
Why learn here
Practitioner-written.
Each lesson is authored by someone who has shipped the control or run the engagement in production.
Quiz after every module.
20+ questions with explanations. 70%+ to mark complete. Unlimited retries.
Progress tracked.
Completions, scores and streaks saved automatically. Resume exactly where you left off.
India-priced.
Start free. ₹499/mo for intermediate. ₹4,999/yr for advanced. No hidden fees, ever.