Copilotfree, in-browser
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
A login form that trusts raw input can hand an attacker the whole database.
SQL Injection
A login form that trusts raw input can hand an attacker the whole database.
Cross-Site Scripting
Cross-site scripting is your JavaScript running in someone else's browser session. That is the whole attack.
Command Injection
Untrusted input reaches the operating system shell, and a second command rides in behind the first.
File Upload Attacks
An avatar uploader that saves an executable file inside the web root hands the attacker code execution.
Server-Side Request Forgery
An app that fetches a URL an attacker controls can reach services the attacker cannot.
Insecure Deserialization
How turning attacker-controlled bytes back into an object can invoke code, and why data-only formats defuse it.
Attacking Authentication
Login is a promise the app must re-check on every request, and it usually slips at the reset flow, the OTP, or the session token.
Access Control and IDOR
Change one id from 1004 to 1003 and read another user's data, because the server checked login but never ownership.