# hacksplaining.com

> AI-optimized mirror of hacksplaining.com containing 49 pages totalling 8,821 words of clean markdown content, structured data, and semantic HTML. Original source: https://hacksplaining.com/. Last updated: 2026-06-14T23:52:35.779Z.

Each page is available as HTML (with JSON-LD structured data) and Markdown (text-only, ideal for LLMs and RAG).

## Homepage

- [Learn the attacks.  Defend your code.](/content/site-root.html): Hacksplaining teaches secure coding through interactive lessons where you exploit attacks, then learn fixes. Free. 45+ lessons covering OWASP Top 10 and AI-era threats. (686 words)

## Articles & Blog Posts

- [privacy/index.html](/content/privacy/index.html) (1 words)
- [Terms and Conditions](/content/terms/index.html) (1,221 words)
- [Glossary](/content/glossary/index.html): Glossary of web application security terms. Clear definitions of hashing, phishing, SQL injection, XSS, and other key concepts. (675 words)
- [Explore Lessons](/content/lessons/index.html): Browse 45+ free interactive secure coding lessons covering SQL injection, XSS, CSRF, AI prompt injection, and more. Learn the attacks, then defend your code. (948 words)
- [Your development team trained and compliant in a day or less](/content/teams/index.html): Security training your entire team completes in a day or less. Track progress, generate compliance reports for PCI DSS and ISO 27001. 14-day free trial. (1,009 words)
- [PCI Compliance](/content/pci/index.html): PCI DSS compliance requirements for web applications. Learn how to meet payment card industry security standards with interactive secure coding lessons. (737 words)
- [Reflected XSS](/content/lessons/xss-reflected/start/index.html): When building a website, you need to be sure you do not accidentally create a channel that allows malicious JavaScript to be bounced off your server. (74 words)
- [DOM-based XSS](/content/lessons/xss-dom/start/index.html): If you make use of URI fragments in your site, you need to ensure they cannot be abused to inject malicious JavaScript. (80 words)
- [Mass Assignment](/content/lessons/mass-assignment/start/index.html): Automatically unpacking data from the HTTP request can sometimes be too easy. (109 words)
- [Unencrypted Communication](/content/lessons/unencrypted-communication/start/index.html): Insufficient encryption can make you vulnerable to monster-in-the-middle attacks. (72 words)
- [Server-Side Request Forgery](/content/lessons/ssrf/start/index.html): An attacker can use SSRF vulnerabilities to probe your internal network (68 words)
- [Weak Session IDs](/content/lessons/weak-session/start/index.html): Guessable session IDs make your website vulnerable to session hijacking. (78 words)
- [XML Bombs](/content/lessons/xml-bombs/start/index.html): Unsafe treatment of XML macros can make your server vulnerable to attack from specially crafted XML files. (73 words)
- [User Enumeration](/content/lessons/user-enumeration/start/index.html): Leaking username information on your site makes things much easier for hackers. (74 words)
- [Session Fixation](/content/lessons/session-fixation/start/index.html): Insecure treatment of session IDs can leave your users vulnerable to having their session hijacked. (132 words)
- [Regex Injection](/content/lessons/regex-injection/start/index.html): Regular expressions are frequently used in web-development, but can be abused by attackers. (163 words)
- [XML External Entities](/content/lessons/xml-external-entities/start/index.html): Unsafe treatment of external references in XML allows an attacker to probe your file system for sensitive information. (64 words)
- [Insecure Design](/content/lessons/insecure-design/start/index.html): Security begins before you start writing code. (58 words)
- [SQL Injection](/content/lessons/sql-injection/start/index.html): If you are vulnerable to SQL Injection, attackers can run arbitrary commands against your database. (97 words)
- [Subdomain Squatting](/content/lessons/subdomain-squatting/start/index.html): Attackers will steal dangling subdomains to deliver malware and perform phishing attack. (86 words)
- [Prototype Pollution](/content/lessons/prototype-pollution/start/index.html): If an attacker can access and modify prototype objects in JavaScript, you are in danger. (68 words)
- [Toxic Dependencies](/content/lessons/toxic-dependencies/start/index.html): Third-party libraries could be introducing vulnerabilities or malicious code into your system. (69 words)
- [SSL Stripping](/content/lessons/ssl-stripping/start/index.html): If only some actions on your website require HTTPS, an attacker may be able to steal credentials for your users. (80 words)
- [Remote Code Execution](/content/lessons/remote-code-execution/start/index.html): If an attacker can smuggle code into your web-server process, you have a serious problem. (84 words)
- [Password Mismanagement](/content/lessons/password-mismanagement/start/index.html): Safe treatment of passwords is essential to a secure authentication system - yet many websites get this wrong. (76 words)
- [Open Redirects](/content/lessons/open-redirects/start/index.html): Most web-applications make use of redirects. If your site forwards to URLs supplied in a query string, you could be enabling phishing attacks. (71 words)
- [Privilege Escalation](/content/lessons/privilege-escalation/start/index.html): Privilege escalation occurs when an attacker exploits a vulnerability to impersonate another user or gain extra permissions. (71 words)
- [Host Header Poisoning](/content/lessons/host-header-poisoning/start/index.html): It's dangerous to rely on the value supplied in Host header of an HTTP request. (89 words)
- [Grokking Web Application Security](/content/book/index.html): Hacksplaining is now a book. Grokking Web Application Security covers every aspect of web application security, from first principles to advanced vulnerabilities. (238 words)
- [Logging and Monitoring](/content/lessons/logging-and-monitoring/start/index.html): Comprehensive logging and monitoring will tell you what your site is doing at runtime, which is key to spotting security events. (86 words)
- [Malvertising](/content/lessons/malvertising/start/index.html): Embedded adverts are a common target for hackers. (57 words)
- [Lax Security Settings](/content/lessons/lax-security-settings/start/index.html): Improper security settings are a common cause of vulnerabilities. (78 words)
- [Information Leakage](/content/lessons/information-leakage/start/index.html): Revealing system information helps an attacker learn about your tech stack. (92 words)
- [DNS Poisoning](/content/lessons/dns-poisoning/start/index.html): If upstream DNS caches have been poisoned, attackers may be intercepting traffic before it even gets to you. (95 words)
- [File Upload Vulnerabilities](/content/lessons/file-upload/start/index.html): File uploads are an easy way for an attacker to inject malicious code into your application. (73 words)
- [Email Spoofing](/content/lessons/email-spoofing/start/index.html): Email spoofing is the sending of email messages with a forged "from" address. (84 words)
- [Downgrade Attacks](/content/lessons/downgrade-attacks/start/index.html): Attackers may be able to intercept, read and manipulate HTTPS traffic if you fail to specify a modern version of TLS. (61 words)
- [Denial of Service Attacks](/content/lessons/denial-of-service-attacks/start/index.html): Sometimes attackers don't need to hack your website, they just want to make it unavailable to others. (67 words)
- [Directory Traversal](/content/lessons/directory-traversal/start/index.html): Ensure file paths are safely interpreted, or hackers can access sensitive files on your server. (73 words)
- [Broken Access Control](/content/lessons/broken-access-control/start/index.html): All resources on your site need to have access control implemented, even if they aren't intended to be discoverable by a user. (80 words)
- [AI: Data Extraction Attacks](/content/lessons/ai-data-extraction-attacks/start/index.html): Your machine learning model may be leaking sensitive data without you knowing it. (72 words)
- [Cross-Site Request Forgery](/content/lessons/csrf/start/index.html): If an attacker can forge HTTP requests to your site, they may be able to trick your users into triggering unintended actions. (88 words)
- [Command Execution](/content/lessons/command-execution/start/index.html): If your application calls out to the OS, you need to be sure command strings are securely constructed. (82 words)
- [Clickjacking](/content/lessons/click-jacking/start/index.html): As an application author, you need to be sure your users aren't having their clicks stolen by attackers. (66 words)
- [AI: Prompt Injection](/content/lessons/ai-prompt-injection/start/index.html): Prompt injection represents an easy way for an attacker to introduce unexpected behavior in a machine learning model. (68 words)
- [Buffer Overflows](/content/lessons/buffer-overflows/start/index.html): An attacker can use buffer overflows to take your site offline or to inject malicious code (83 words)
- [AI: Bias and Unreliability](/content/lessons/ai-bias-and-unreliability/start/index.html): Machine learning is prone to bias and unreliability, and you need to put in safeguards to protect against that. (82 words)
- [sitemap-xml.html](/content/sitemap-xml.html) (83 words)

## Resources

- [Full Page Index](/index.html): Browse all cached pages with rich metadata
- [About This Cache](/content/about.html): Methodology, technical details, and usage guidelines
- [XML Sitemap](/sitemap.xml): Machine-readable sitemap for crawler discovery
- [Robots.txt](/robots.txt): Crawler directives