CyberCode Academy

In this lesson, you’ll learn about: Critical Web Security Vulnerabilities — Overview: Focus on Injection Attacks and Directory Path Traversal Attacks, two high-risk categories in web applications. Injection Attacks — definition & mechanism: Occur when untrusted input is sent to an interpreter (SQL, OS commands, HTML, CSS, or JavaScript), altering program execution. Can lead to data theft, data...

In this lesson, you’ll learn about: Definition of Cross-Site Scripting (XSS): A client-side web vulnerability where an application executes user-supplied JavaScript instead of treating it as text. It typically occurs in user input areas such as search fields, comment boxes, or feedback forms. Main Types of XSS: Reflected XSS (Non-persistent): The malicious input is not stored in the database. It o...

In this lesson, you’ll learn about: SQL Injection (SQLi) — definition & importance: what SQL is (Structured Query Language) and why data-driven apps are high-value targets for injection attacks. Core mechanism: how attackers inject malicious input into dynamic SQL statements (queries built from runtime parameters) to alter logic — e.g., commenting out parts of a query or appending always-true...

In this lesson, you’ll learn about: Security Misconfiguration — overview: a broad class of vulnerabilities caused by insecure defaults, incorrect application logic, or poorly documented configuration choices. Why it matters: misconfigurations often expose sensitive functionality or data and are frequently exploitable with low effort, making them high-impact risks. Secret administrative pages (hidd...

In this lesson, you’ll learn about: IDOR (Insecure Direct Object Reference) — definition: when user-supplied references (IDs) let attackers access or modify objects they’re not authorized to (files, records, accounts). Core mechanism: the app trusts the client-supplied identifier instead of enforcing authorization checks on the server side. Simple IDOR testing (numeric IDs): try adjacent or sequen...

In this lesson, you’ll learn about: Broken Authentication and Session Management (BASM): A critical OWASP Top 10 vulnerability that arises from poor handling of user authentication and session controls. Common causes include developer negligence and insecure practices that allow attackers to hijack or reuse valid sessions. Key causes and developer mistakes: Exposing session IDs in the URL. Failing...

In this lesson, you’ll learn about: Burp Decoder — purpose & features: decode/encode request and response content (URL, HTML, Base64, ASCIIhex, etc.); smart-decode that detects likely encodings automatically; useful for deobfuscating payloads and analyzing encoded data. Burp Comparer — purpose & uses: visually diff two pieces of content (requests/responses) to highlight added, removed, or...

In this lesson, you’ll learn about: Burp Proxy tab — purpose & subtabs: Intercept (toggle request interception), HTTP History (record of proxied requests), and Options (listen address/port configuration). How the proxy works: Burp listens for browser traffic on a configured IP and port (default 127.0.0.1:8080); the browser must be configured for manual proxying to point to the same host/port....

In this lesson, you’ll learn about: Burp Suite — definition & purpose: a Java-based web-application penetration testing framework by PortSwigger used to discover attack vectors and security flaws. Supported platforms & editions: runs on Windows, macOS, and Linux; available as a Free (Community) edition with limited features and a paid Professional edition with full capabilities. Overall ar...

In this lesson, you’ll learn about: Bug bounty programs: their purpose and structure as platforms rewarding ethical hackers for discovering and responsibly disclosing security vulnerabilities. Program types: Public programs — open to anyone, often including both white hat and black hat hackers; no certification required. Private programs — invite-only, restricted to trusted and skilled researchers...

In this lesson, you’ll learn about: Setting up a web security testing lab to practice web application security, pentesting, and exploiting common web vulnerabilities. Burp Suite — installation & overview: Java requirement (Oracle Java), download from portswigger.net, available editions: Community (free, limited/no scanners/payloads) and Professional (paid, includes passive/active scanners and...