Cybersecurity, learned like a practitioner.

24 learning paths · 398 modules live · every lesson written by someone who has shipped the control or run the engagement. Free to start.

24
Learning paths
398+
Live modules
0
You've completed
Free
Your tier
Browse the academy

Attacker Mindset — Web · modules

Why each web vuln class exists — trust boundaries, grammar confusion, authorization drift. Mindset first, tools second.

12 results · Page 1/2
Attacker Mindset — Web Intermediate Free

Module 16 · The Three Types of Web Sessions

“Session” is overloaded: browser session (open tabs), server session (data keyed by session ID), application session (the user’s logical workflow). Each has different lifetime; each has different invalidation rules. The bug pattern: developer thinks “user logged out, session ended.” Browser session ended. Server session may persist. JWT may still be valid. OAuth refresh token still […]

Apr 27, 2026 15 min Open
Attacker Mindset — Web Intermediate Free

Module 17 · Why HTTP Headers Are Programmable Trust

Application code routinely trusts HTTP headers. X-Forwarded-For for client IP. Host for routing. Origin for CORS. Each is attacker-controllable in some path. If your code does if (request.headers["X-Admin-Override"] == "true"), you’ve created a backdoor. If your code trusts X-Forwarded-For without validating the immediate peer, you’ve created an IP-spoofing primitive. The mindset: each header your code […]

Apr 27, 2026 15 min Open
Attacker Mindset — Web Intermediate Free

Module 18 · CDN as Attack Surface

CDN was once a passive cache. Now: edge functions, header rewriting, cache key manipulation, custom routing. Each is a new attack surface. Cache poisoning, cache deception, edge-function privilege escalation, header injection between CDN and origin — all bug classes that didn’t exist when CDN was just static-asset cache. The mindset: list every CDN feature you […]

Apr 27, 2026 15 min Open
Attacker Mindset — Web Intermediate Free

Module 19 · The 5 Trust Boundaries in Every Web App

Trust boundaries are where one component trusts data from another. Each crossing is a place to validate. Most apps have at least 5: Browser to server (the obvious one — input validation) Server to database (parameterised queries) Server to upstream API (output validation, response-content trust) Server to cache (cache-key collisions, deserialisation) Server to message queue […]

Apr 27, 2026 15 min Open
Attacker Mindset — Web Intermediate Free

Module 20 · Reading Other People’s Code With Suspicion

Most code review looks for “does it work?” Security code review asks “does it work for inputs the author didn’t imagine?” The questions: What does the author assume about input format? What language quirk could surprise this code? What if this is concurrent? What if the dependency does something unexpected? What if the user’s session […]

Apr 27, 2026 15 min Open
Attacker Mindset — Web Intermediate Free

Module 13 · Browser Origin Boundaries

Same-Origin Policy is the bedrock of web security. But “origin” has nuances: scheme matters, port matters, path doesn’t. Subdomains aren’t same-origin (they’re same-site, different concept). CORS is opt-in cross-origin. It carries credentials only with explicit allow. Access-Control-Allow-Origin: * with credentials is invalid. Many implementations get this wrong. postMessage crosses origins by design. Receiver must validate […]

Apr 27, 2026 15 min Open
Attacker Mindset — Web Intermediate Free

Module 11 · Why Validation at Multiple Layers

Defence in depth is a phrase. Multi-layer validation is its application. Client-side validation catches user mistakes. Edge validation (WAF) catches bulk attacks. Server-side validation enforces business rules. Database constraints catch the rest. Each catches what the others miss. Skip a layer = bypass that layer’s coverage entirely. The mistake: assuming “the WAF catches it” or […]

Apr 27, 2026 15 min Open
Attacker Mindset — Web Intermediate Free

Module 12 · The Cookie Confusion Cascade

Cookies are the most-misunderstood browser feature. Domain attribute, path, SameSite, Secure, HttpOnly, Partitioned — each affects when the browser sends the cookie. Combinations produce surprising behaviour. Examples that catch defenders off guard: cookie set on parent domain visible to subdomain (intentional, abuseable); SameSite=Lax allows top-level navigation cookies (CSRF window); Partitioned cookies behave differently per top-level […]

Apr 27, 2026 15 min Open
Attacker Mindset — Web Intermediate Free

Module 14 · Authentication vs Authorization Split

Authentication: who are you. Authorization: what can you do. Most security education conflates them. Most bugs live in the gap. An authenticated user is not authorized for everything they ask. Authorization is per-resource, per-action, often per-attribute. IDOR exists because authn is correct but authz is missing. The mindset: at every endpoint, two questions: “is this […]

Apr 27, 2026 15 min Open
Attacker Mindset — Web Intermediate Free

Module 15 · State Machines Have More Edges Than You Think

Every web app is a state machine. Order = pending → paid → shipped → delivered. State transitions have rules. The rules have gaps. Attackers enumerate edges adversarially: can I go from pending to delivered, skipping paid? Can I cancel after shipped? Can I trigger paid → paid (double payment processing)? The mindset: draw the […]

Apr 27, 2026 15 min Open
02 / Why learn here

Practitioners who've
shipped the controls.

Every module is written by someone who has built the defence or run the engagement. No repackaged tutorials, no generic theory.

Why learn here

01

Practitioner-written.

Each lesson is authored by someone who has shipped the control or run the engagement in production.

02

Quiz after every module.

20+ questions with explanations. 70%+ to mark complete. Unlimited retries.

03

Progress tracked.

Completions, scores and streaks saved automatically. Resume exactly where you left off.

04

India-priced.

Start free. ₹499/mo for intermediate. ₹4,999/yr for advanced. No hidden fees, ever.