# Explore Lessons Interactive lessons covering the most common web security vulnerabilities. - New ### AI: Prompt Injection Prompt injection represents an easy way for an attacker to introduce unexpected behavior in a machine learning model. [Explore Lesson →](/content/lessons/ai-prompt-injection/start/index.html) - New ### AI: Data Extraction Attacks Your machine learning model may be leaking sensitive data without you knowing it. [Explore Lesson →](/content/lessons/ai-data-extraction-attacks/start/index.html) - New ### AI: Bias and Unreliability Machine learning is prone to bias and unreliability, and you need to put in safeguards to protect against that. [Explore Lesson →](/content/lessons/ai-bias-and-unreliability/start/index.html) - ### Broken Access Control All resources on your site need to have access control implemented, even if they aren't intended to be discoverable by a user. [Explore Lesson →](/content/lessons/broken-access-control/start/index.html) - ### Buffer Overflows An attacker can use buffer overflows to take your site offline or to inject malicious code [Explore Lesson →](/content/lessons/buffer-overflows/start/index.html) - ### Clickjacking As an application author, you need to be sure your users aren't having their clicks stolen by attackers. [Explore Lesson →](/content/lessons/click-jacking/start/index.html) - ### Command Execution If your application calls out to the OS, you need to be sure command strings are securely constructed. [Explore Lesson →](/content/lessons/command-execution/start/index.html) - ### Cross-Site Request Forgery If an attacker can forge HTTP requests to your site, they may be able to trick your users into triggering unintended actions. [Explore Lesson →](/content/lessons/csrf/start/index.html) - ### Denial of Service Attacks Sometimes attackers don't need to hack your website, they just want to make it unavailable to others. [Explore Lesson →](/content/lessons/denial-of-service-attacks/start/index.html) - ### Directory Traversal Ensure file paths are safely interpreted, or hackers can access sensitive files on your server. [Explore Lesson →](/content/lessons/directory-traversal/start/index.html) - ### DNS Poisoning If upstream DNS caches have been poisoned, attackers may be intercepting traffic before it even gets to you. [Explore Lesson →](/content/lessons/dns-poisoning/start/index.html) - ### Downgrade Attacks Attackers may be able to intercept, read and manipulate HTTPS traffic if you fail to specify a modern version of TLS. [Explore Lesson →](/content/lessons/downgrade-attacks/start/index.html) - ### Email Spoofing Email spoofing is the sending of email messages with a forged "from" address. [Explore Lesson →](/content/lessons/email-spoofing/start/index.html) - ### File Upload Vulnerabilities File uploads are an easy way for an attacker to inject malicious code into your application. [Explore Lesson →](/content/lessons/file-upload/start/index.html) - ### Host Header Poisoning It's dangerous to rely on the value supplied in Host header of an HTTP request. [Explore Lesson →](/content/lessons/host-header-poisoning/start/index.html) - ### Information Leakage Revealing system information helps an attacker learn about your tech stack. [Explore Lesson →](/content/lessons/information-leakage/start/index.html) - ### Insecure Design Security begins before you start writing code. [Explore Lesson →](/content/lessons/insecure-design/start/index.html) - ### Lax Security Settings Improper security settings are a common cause of vulnerabilities. [Explore Lesson →](/content/lessons/lax-security-settings/start/index.html) - ### Logging and Monitoring Comprehensive logging and monitoring will tell you what your site is doing at runtime, which is key to spotting security events. [Explore Lesson →](/content/lessons/logging-and-monitoring/start/index.html) - ### Malvertising Embedded adverts are a common target for hackers. [Explore Lesson →](/content/lessons/malvertising/start/index.html) - ### Mass Assignment Automatically unpacking data from the HTTP request can sometimes be too easy. [Explore Lesson →](/content/lessons/mass-assignment/start/index.html) - ### Open Redirects Most web-applications make use of redirects. If your site forwards to URLs supplied in a query string, you could be enabling phishing attacks. [Explore Lesson →](/content/lessons/open-redirects/start/index.html) - ### Password Mismanagement Safe treatment of passwords is essential to a secure authentication system - yet many websites get this wrong. [Explore Lesson →](/content/lessons/password-mismanagement/start/index.html) - ### Privilege Escalation Privilege escalation occurs when an attacker exploits a vulnerability to impersonate another user or gain extra permissions. [Explore Lesson →](/content/lessons/privilege-escalation/start/index.html) - ### Prototype Pollution If an attacker can access and modify prototype objects in JavaScript, you are in danger. [Explore Lesson →](/content/lessons/prototype-pollution/start/index.html) - ### Regex Injection Regular expressions are frequently used in web-development, but can be abused by attackers. [Explore Lesson →](/content/lessons/regex-injection/start/index.html) - ### Remote Code Execution If an attacker can smuggle code into your web-server process, you have a serious problem. [Explore Lesson →](/content/lessons/remote-code-execution/start/index.html) - ### Session Fixation Insecure treatment of session IDs can leave your users vulnerable to having their session hijacked. [Explore Lesson →](/content/lessons/session-fixation/start/index.html) - ### SQL Injection If you are vulnerable to SQL Injection, attackers can run arbitrary commands against your database. [Explore Lesson →](/content/lessons/sql-injection/start/index.html) - ### SSL Stripping If only some actions on your website require HTTPS, an attacker may be able to steal credentials for your users. [Explore Lesson →](/content/lessons/ssl-stripping/start/index.html) - ### Server-Side Request Forgery An attacker can use SSRF vulnerabilities to probe your internal network [Explore Lesson →](/content/lessons/ssrf/start/index.html) - ### Subdomain Squatting Attackers will steal dangling subdomains to deliver malware and perform phishing attack. [Explore Lesson →](/content/lessons/subdomain-squatting/start/index.html) - ### Toxic Dependencies Third-party libraries could be introducing vulnerabilities or malicious code into your system. [Explore Lesson →](/content/lessons/toxic-dependencies/start/index.html) - ### Unencrypted Communication Insufficient encryption can make you vulnerable to monster-in-the-middle attacks. [Explore Lesson →](/content/lessons/unencrypted-communication/start/index.html) - ### User Enumeration Leaking username information on your site makes things much easier for hackers. [Explore Lesson →](/content/lessons/user-enumeration/start/index.html) - ### Weak Session IDs Guessable session IDs make your website vulnerable to session hijacking. [Explore Lesson →](/content/lessons/weak-session/start/index.html) - ### XML Bombs Unsafe treatment of XML macros can make your server vulnerable to attack from specially crafted XML files. [Explore Lesson →](/content/lessons/xml-bombs/start/index.html) - ### XML External Entities Unsafe treatment of external references in XML allows an attacker to probe your file system for sensitive information. [Explore Lesson →](/content/lessons/xml-external-entities/start/index.html) - ### DOM-based XSS If you make use of URI fragments in your site, you need to ensure they cannot be abused to inject malicious JavaScript. [Explore Lesson →](/content/lessons/xss-dom/start/index.html) - ### Reflected XSS When building a website, you need to be sure you do not accidentally create a channel that allows malicious JavaScript to be bounced off your server. [Explore Lesson →](/content/lessons/xss-reflected/start/index.html) - ### Cross-Site Scripting If your site allows users to add content, you need to be sure that attackers cannot inject malicious JavaScript. [Explore Lesson →](/content/lessons/xss-stored/start/index.html) - ### Cross-Site Script Inclusion If you are putting sensitive data in your JavaScript files an attacker is probably stealing it. [Explore Lesson →](/content/lessons/xssi/start/index.html)