Badges

Each badge is an ordered set of exercises on one skill. Finish them all to earn the badge and a shareable certificate of completion.

How the web actually works and where its bugs come from. Finish this before anything else: every later badge assumes…

Input that becomes code. SQL injection, cross site scripting, OS command injection and path traversal — how each one…

Who are you, and what are you allowed to do? Broken access control, password storage, sessions, CSRF and JSON Web…

Bugs that reach past the app into the server and the network: command injection, path traversal and server side request…

Find the bug by reading the source. The source to sink method applied to SQL injection, XSS in templates, and the…

Map before you test, and never test without permission. Reconnaissance and port scanning, plus the scope and rules of…

Set up the tools and practice targets you will use for everything else — an intercepting proxy and two deliberately…