Type to search across the blog, guides, tools, and services.
Step-by-step, genuinely offensive walkthroughs: how each vulnerability is exploited and how each core tool is used, with exact commands and payloads. Every walkthrough targets a legal practice lab you run yourself.
SQL injection is when you type database commands into a normal input box, and because the app pastes your text straight into its query, the database runs your commands instead of just treating them as data.
Lab: OWASP Juice ShopIDOR is when an app trusts an id you send it: change the id in a request from yours to someone else's, and it hands you their data because it never checks who you are.
Lab: DVWAXSS is when you get a website to run your JavaScript in someone else's browser, because the site printed your input onto the page without cleaning it first.
Lab: DVWACSRF tricks your logged-in browser into secretly submitting a request you did not mean to send, because the site trusts your session cookie and does not check that you actually meant to do it.
Lab: PortSwigger Web Security AcademySSRF is when you make the server fetch a URL for you, then point it at things you should not be able to reach, like its own internal admin panel or cloud metadata.
Lab: DVWABroken authentication is when the login is weak enough to break: no limit on guesses, weak passwords, or flaws in reset and session handling, so an attacker can get in as someone else.
Lab: DVWACommand injection is when an app runs a system command using your input, so you sneak in an extra command and the server runs it for you.
Lab: PortSwigger Web Security AcademyXXE is when an app parses XML you send and you sneak in a special entity that makes the parser go read a file off the server and hand it back to you.
Lab: PortSwigger Web Security AcademyApps sometimes turn objects into a string to store or send, then rebuild them later. Insecure deserialization is when you edit that string, and the app trustingly rebuilds the tampered object.
Lab: OWASP Juice ShopSecurity misconfiguration is when the app or server is set up carelessly: default passwords, exposed files, debug mode on, so an attacker just walks in through a door left open.
Nmap is a tool that knocks on all the doors of a computer to see which are open, and then asks each open door what service is behind it.
Tool guideBurp Suite sits between your browser and a website so you can see every request, pause it, change it, and resend it, which is how web hackers poke at an app.
Tool guideWireshark records the network conversations your computer has and lets you read them, so you can see exactly what data is flowing and whether it is protected.
Tool guideSQLmap is a tool that automatically finds and exploits SQL injection for you, then pulls the database apart, once you have understood how the attack works by hand.
Tool guideGobuster rapidly guesses the hidden pages, folders, and files on a website from a wordlist, so you can find the parts that are there but not linked anywhere.
Tool guideNikto quickly checks a web server against a big list of known problems and risky files, giving you a fast first look at what might be wrong.
Tool guideHydra rapidly tries lots of username and password combinations against a login until one works, so you can test how weak or well-protected a login really is.
Tool guideJohn the Ripper takes scrambled password hashes and figures out the original passwords by trying huge numbers of guesses very fast, all on your own machine.
My 35-week mentorship covers everything here in a deliberate order, on real labs, with one-on-one feedback on your work, so it adds up to a career instead of a pile of scattered tutorials.
See the mentorship