Web Exploitation

Exploiting vulnerabilities in web applications. Common topics include SQL injection, XSS, CSRF, SSRF, authentication bypasses, and insecure deserialization.

SQL Injection
XSS
CSRF
SSRF
JWT
OAuth

What is Web Exploitation?

Websites take input from you all the time, logins, search bars, URLs, and trust that input to behave. Web Exploitation is about finding the places where that trust is misplaced, and using it to see data or do things you shouldn’t be able to.

In CTFs, this usually means poking at a live web app in your browser or with a tool like Burp Suite until a form field, cookie, or API endpoint gives up more than it should, often revealing the flag directly.

xkcd comic Exploits of a Mom: a school calls about a database problem after a mother names her son Robert'); DROP TABLE Students;--, referencing SQL injection
“Exploits of a Mom” — xkcd.com/327

Beginner’s Guide to Web Exploitation

You don’t need to know every vulnerability class to start, these four cover most beginner challenges:

SQL Injection (SQLi)

Sneaking database commands into an input field, e.g. typing admin'– into a login box to skip the password check entirely. To learn more, check out the

PortSwigger Academy labs.

Cross-Site Scripting (XSS)

Getting your own JavaScript to run in someone else's browser by sneaking it into a comment, search box, or URL. Test your skills at the

PortSwigger Academy labs.

Broken Access Control / IDOR

Changing an ID in a URL or request (like /invoice?id=101 to 102) to view data that isn't yours. Explore this at the

PortSwigger Academy labs.

Inspecting Requests

Many challenges can be approached by opening your browser's DevTools (F12) or Burp Suite to see the raw requests, cookies, and hidden form fields a normal user would never notice.

Resources & Tools

PortSwigger Web Security Academy

The most recommended starting point in the community: free lessons plus real hands-on labs for every vulnerability class.

OWASP Top 10

The industry-standard list of the most common and impactful web vulnerabilities.

OWASP Juice Shop

A deliberately vulnerable web app you can legally attack to practice everything you've learned.

Burp Suite Community Edition

The go-to free tool for intercepting and tampering with requests between your browser and a website.

Google XSS Game

A short, fun set of levels purely focused on learning Cross-Site Scripting.

Challenges

Simple Login Bypass

A login form vulnerable to SQL injection. Try logging in as admin without knowing the password by injecting into the username field.

SELECT * FROM users WHERE username = '...' AND password = '...';