Website Hacking Course

Lesson 1 • Legal and Ethical Boundaries

Defines authorised testing, responsible disclosure, and ethical obligations. Ensures students operate within professional and legal boundaries throughout the course.

Lesson 2 • Attacker Mindset and Methodology

Introduces the offensive security mindset and structured attack phases. Frames all subsequent techniques within a repeatable, professional methodology.

Lesson 3 • Web Application Architecture

Examines front-end, back-end, and database layers plus common frameworks. Connects architecture knowledge to identifying which layer a vulnerability lives in.

Lesson 4 • How Websites Work

Covers HTTP/HTTPS request-response cycles, DNS resolution, and server roles. Establishes the technical baseline needed for every attack technique in the course.

Lesson 1 • Passive Reconnaissance Techniques

Covers OSINT methods that gather data without touching the target server. Feeds directly into attack planning by revealing infrastructure and personnel details.

Lesson 2 • Active Reconnaissance Techniques

Teaches direct probing methods including port scanning and banner grabbing. Builds on passive findings to confirm live services and technology stacks.

Lesson 3 • DNS Enumeration

Explores zone transfers, DNS brute-forcing, and record analysis. Expands the attack surface map by uncovering hidden subdomains and internal hostnames.

Lesson 1 • Vulnerability Prioritisation and Reporting

Applies severity scoring and business-impact analysis to rank findings. Prepares students to communicate risk clearly to technical and non-technical stakeholders.

Lesson 2 • OWASP Top 10 Overview

Maps the most critical web vulnerability categories to real-world impact. Provides the classification framework used throughout the rest of the course.

Lesson 3 • Web Application Scanning Fundamentals

Introduces automated scanners, their output formats, and false-positive management. Connects reconnaissance data to targeted scan configuration.

Lesson 1 • Advanced SQL Injection Techniques

Covers out-of-band exfiltration, stored procedures, and second-order injection. Extends basic skills to complex, real-world database configurations.

Lesson 2 • Command and Code Injection

Demonstrates OS command injection and server-side code execution vulnerabilities. Connects injection concepts to server-level compromise beyond the database.

Lesson 3 • Injection Defence and Remediation

Reviews parameterised queries, input validation, and least-privilege database accounts. Equips students to recommend concrete fixes after demonstrating injection impact.

Lesson 4 • NoSQL and XML Injection

Targets MongoDB query operators and XML/XPath parsers with injection payloads. Broadens injection skills to non-relational and document-based data stores.

Lesson 1 • Session Token Analysis and Hijacking

Analyses token entropy, predictability, and transmission security to steal sessions. Builds on HTTP fundamentals to show how sessions can be captured or forged.

Lesson 2 • Credential-Based Attacks

Covers brute-force, credential stuffing, and password spraying against login endpoints. Directly applies reconnaissance data to target real user accounts.

Lesson 3 • Authentication Logic Flaws

Identifies flawed multi-step login flows, insecure password reset, and MFA bypass. Demonstrates that logic errors are as dangerous as missing input validation.

Lesson 1 • Clickjacking and UI Redressing

Demonstrates iframe-based attacks that trick users into unintended clicks. Connects client-side attack knowledge to interface manipulation beyond script injection.

Lesson 2 • Content Security Policy and XSS Bypass

Analyses CSP directives and demonstrates common misconfigurations that allow bypass. Prepares students to both evaluate defences and recommend correct CSP policies.

Lesson 3 • DOM-Based XSS

Targets client-side JavaScript sinks that process attacker-controlled sources. Extends XSS skills to single-page applications and modern JavaScript frameworks.

Lesson 4 • Reflected and Stored XSS

Distinguishes reflected from stored XSS and demonstrates payload delivery for each. Establishes XSS fundamentals before moving to DOM-based and advanced variants.

Lesson 1 • Broken Access Control Fundamentals

Covers horizontal and vertical privilege escalation through parameter manipulation. Establishes the distinction between authentication and authorisation as attack targets.

Lesson 2 • Insecure Direct Object References

Demonstrates IDOR in file downloads, API endpoints, and database record access. Builds systematic enumeration skills for finding exposed object references.

Lesson 3 • API Authorization Testing

Tests REST and GraphQL APIs for missing authorisation checks and excessive data exposure. Extends access control skills to modern API-driven architectures.

Lesson 1 • Server-Side Request Forgery

Forces the server to make internal requests, exposing cloud metadata and internal services. Demonstrates how SSRF bridges external access to internal network resources.

Lesson 2 • Professional Penetration Test Reporting

Structures findings into a complete penetration test report with executive and technical sections. Translates technical exploitation results into actionable remediation guidance.

Lesson 3 • File Upload and Path Traversal Attacks

Bypasses file upload restrictions to plant web shells and reads arbitrary server files. Combines injection and access control knowledge into server-level compromise.

Lesson 4 • Vulnerability Chaining and Pivoting

Combines low-severity findings into high-impact exploit chains targeting critical assets. Develops strategic thinking required for advanced penetration testing engagements.