Web Frameworks
0%
Web Frameworks: Code Review
Read web app source like an attacker: trace user input to dangerous sinks, triage with Semgrep.
0%
Web Frameworks: Java
Review Spring Boot source, find the framework-specific sinks, and exploit each on the lab machine.
0%
Web Frameworks: Python
Review Django and Flask source for framework-specific sinks, then exploit each on the lab machine.
0%
Web Frameworks: .NET
Review ASP.NET source, find the framework-specific sinks, and exploit each on the lab machine.
0%
Source Code Review: PHP
Learn the basics of source code review for PHP.
Topic Rewind Recap
Lock in what you learned with a recap. Earn points and keep your streak.
Learn how to read a framework's source code like an attacker and exploit the bugs it ships by default.
This module covers white-box web application testing: tracing a vulnerability from source code to a working exploit across the frameworks that carry most production traffic. Learners start with the review method itself, reading code, mapping attack surface, and grepping for dangerous patterns, before applying it stack by stack. Spring Boot brings Actuator misconfiguration, SQL injection below the ORM, mass assignment, and deserialisation. Django and Flask bring debug exposure, session forgery, and template injection. ASP.NET brings ViewState tampering, mass assignment, and deserialisation. Each framework room ends with a practical task chaining that stack's bugs into one exploit path, and a hard capstone challenge closes the module by combining four Spring Boot flaws in a single unredacted codebase to reach remote code execution.
What are modules?
A learning pathway is made up of modules, and a module is made of bite-sized rooms (think of a room like a mini security lab).
