Courses
1. Introduction to Blockchain and Solana
2. Setting Up Your Development Environment
3. Solana Architecture and Key Concepts
4. Creating and Managing Wallets
5. Understanding Solana Programs
6. Building Your First Solana Program
7. Deploying Programs on the Solana Network
8. Interacting with Solana Programs
9. Using Solana CLI and SDKs
10. Developing Decentralized Applications (DApps)
11. Smart Contract Security Best Practices
12. Testing and Debugging Solana Programs
13. Optimizing Performance on Solana
14. Exploring Solana Ecosystem Tools
1. Introduction to Blockchain and Ethereum
2. Setting Up Your Development Environment
3. Ethereum Architecture and Key Concepts
4. Creating and Managing Wallets
5. Understanding Smart Contracts
6. Building Your First Smart Contract
7. Deploying Smart Contracts on the Ethereum Network
8. Interacting with Smart Contracts
9. Using Ethereum CLI and SDKs
10. Developing Decentralized Applications (DApps)
11. Smart Contract Security Best Practices
12. Testing and Debugging Smart Contracts
13. Optimizing Performance on Ethereum
14. Exploring Ethereum Ecosystem Tools
1. Introduction to Blockchain and Polygon
2. Setting Up Your Development Environment
3. Polygon Architecture and Key Concepts
4. Creating and Managing Wallets
5. Understanding Smart Contracts on Polygon
6. Building Your First Smart Contract on Polygon
7. Deploying Smart Contracts on the Polygon Network
8. Interacting with Smart Contracts on Polygon
9. Using Polygon CLI and SDKs
10. Developing Decentralized Applications (DApps) on Polygon
11. Smart Contract Security Best Practices for Polygon
12. Testing and Debugging Smart Contracts on Polygon
13. Optimizing Performance on Polygon
14. Exploring Polygon Ecosystem Tools
1. JavaScript Prototype Pollution
2. Advanced Server-Side Request Forgery (SSRF)
3. Web Security Tools and Methodologies
4. Source Code Analysis
5. Persistent Cross-Site Scripting
6. Session Hijacking
7. .NET Deserialization
8. Remote Code Execution
9. Blind SQL Injection
10. Data Exfiltration
11. Bypassing File Upload Restrictions and File Extension Filters
12. PHP Type Juggling with Loose Comparisons
13. PostgreSQL Extension and User-Defined Functions
14. Bypassing REGEX Restrictions
15. Magic Hashes
16. Bypassing Character Restrictions
17. UDF Reverse Shells
18. PostgreSQL Large Objects
19. DOM-Based Cross-Site Scripting (Black Box)
20. Server-Side Template Injection
21. Weak Random Token Generation
22. XML External Entity Injection
23. RCE via Database Functions
24. OS Command Injection via WebSockets (Black Box)
Introduction to Web Applications
OSCP · Chapter 5
Introduction to Web Applications
Modern penetration testing spends most of its time on web applications, since they are the most common attacker-facing surface. Understanding HTTP requests, sessions, and how the client/server boundary is trusted (or not) is the prerequisite for everything else in this track.
Key concepts
- Every request/response pair is an opportunity: headers, cookies, hidden form fields and query parameters are all attacker-controllable input.
- A proxy (Burp Suite / OWASP ZAP) sitting between browser and server is the single most useful tool for web testing — it lets you intercept, replay and fuzz requests.
- Understand trust boundaries: anything sent from the browser must be treated as untrusted by the server, no matter how much client-side validation exists.
- Map the application first (spidering, auth flows, API endpoints) before attacking anything — you cannot test what you have not found.
Try it yourself
Install Burp Suite Community Edition, configure your browser to proxy through it, and browse any lab application. Inspect one request/response pair and identify every piece of client-controlled data in it.