Lesson Library
Learn how to prevent common vulnerabilities.
New
AI: Bias and Unreliability
Machine learning is prone to bias and
unreliability, and you need to put in
safeguards to protect against that.
Learn About This Vulnerability →
New
AI: Prompt Injection
Prompt injection represents an easy way
for an attacker for an attacker to
introduce unexpected behavior in a
machine learning model.
Learn About This Vulnerability →
New
AI: Data Extraction Attacks
Your machine learning model may be
leaking sensitive data without you
knowing it.
Learn About This Vulnerability →
SQL Injection
If you are vulnerable to SQL Injection,
attackers can run arbitrary commands
against your database.
Learn About This Vulnerability →
Cross-Site Scripting
If your site allows users to add content,
you need to be sure that attackers cannot
inject malicious JavaScript.
Learn About This Vulnerability →
Command Execution
If your application calls out to the OS, you
need to be sure command strings are
securely constructed.
Learn About This Vulnerability →
Clickjacking
As an application author, you need to be
sure your users aren't having their clicks
stolen by attackers.
Learn About This Vulnerability →
Cross-Site Request Forgery
If an attacker can forge HTTP requests to
your site, they may be able to trick your
users into triggering unintended actions.
Learn About This Vulnerability →
Directory Traversal
Ensure file paths are safely interpreted, or
hackers can access sensitive files on your
server.
Learn About This Vulnerability →
Reflected XSS
When building a website, you need to be
sure you do not accidentally create a
channel that allows malicious JavaScript
to be bounced off your server.
Learn About This Vulnerability →
DOM-based XSS
If you make use of URI fragments in your
site, you need to ensure they cannot be
abused to inject malicious JavaScript.
Learn About This Vulnerability →
File Upload Vulnerabilities
File uploads are an easy way for an
attacker to inject malicious code into your
application.
Learn About This Vulnerability →
Broken Access Control
All resources on your site need to have
access control implemented, even if they
aren't intended to be discoverable by a
user.
Learn About This Vulnerability →
Open Redirects
Most web-applications make use of
redirects. If your site forwards to URLs
supplied in a query string, you could be
enabling phishing attacks.
Learn About This Vulnerability →
Unencrypted Communication
Insufficient encryption can make you
vulnerable to monster-in-the-middle
attacks.
Learn About This Vulnerability →
User Enumeration
Leaking username information on your
site makes things much easier for hackers.
Learn About This Vulnerability →
Information Leakage
Revealing system information helps an
attacker learn about your tech stack.
Learn About This Vulnerability →
Password Mismanagement
Safe treatment of passwords is essential
to a secure authentication system - yet
many websites get this wrong.
Learn About This Vulnerability →
Privilege Escalation
Privilege escalation occurs when an
attacker exploits a vulnerability to
impersonate another user or gain extra
permissions.
Learn About This Vulnerability →
Session Fixation
Insecure treatment of session IDs can
leave your users vulnerable to having their
session hijacked.
Learn About This Vulnerability →
Weak Session IDs
Guessable session IDs make your website
vulnerable to session hijacking.
Learn About This Vulnerability →
XML Bombs
Unsafe treatment of XML macros can
make your server vulnerable to attack
from specially crafted XML files.
Learn About This Vulnerability →
XML External Entities
Unsafe treatment of external references in
XML allows an attacker to probe your file
system for sensitive information.
Learn About This Vulnerability →
Denial of Service Attacks
Sometimes attackers don't need to hack
your website, they just want to make it
unavailable to others.
Learn About This Vulnerability →
Email Spoofing
Email spoofing is the sending of email
messages with a forged "from" address.
Learn About This Vulnerability →
Malvertising
Embedded adverts are a common target
for hackers.
Learn About This Vulnerability →
Lax Security Settings
Improper security settings are a common
cause of vulnerabilities.
Learn About This Vulnerability →
Toxic Dependencies
Third-party libraries could be introducing
vulnerabilities or malicious code into your
system.
Learn About This Vulnerability →
Logging and Monitoring
Comprehensive logging and monitoring
will tell you what your site is doing at
runtime, which is key to spotting security
events
Learn About This Vulnerability →
Buffer Overflows
An attacker can use buffer overflows to
take your site offline or to inject malicious
code
Learn About This Vulnerability →
Server-Side Request Forgery
An attacker can use SSRF vulnerabilities
to probe your internal network
