Application security knowledge
Vulnerability guides.
Browse practical guides to understand common web application vulnerabilities, how they work, where they appear, and how to prevent them in production systems.
7 guides
Brute force attack vulnerability
Learn what brute force attacks are, how password guessing, credential stuffing, password spraying, weak lockout logic, and OTP abuse work, and how to prevent account takeover with rate limiting, MFA, monitoring, and safer authentication design.
Cross-Site Request Forgery vulnerability
Learn what Cross-Site Request Forgery is, how CSRF abuses authenticated browser sessions, where it appears in web applications and APIs, and how to prevent it with anti-CSRF tokens, SameSite cookies, origin checks, and safe request design.
IDOR vulnerability
Learn what IDOR is, how insecure direct object references expose data, where object-level authorization fails, and how to prevent IDOR and BOLA in web applications and APIs.
Rate Limit vulnerability
Learn what rate limit vulnerabilities are, how missing throttling enables automated abuse, resource exhaustion, account attacks, API scraping, and cost spikes, and how to prevent rate limit attacks with endpoint budgets, identity-aware controls, monitoring, and safe retry behavior.
Server-side template injection vulnerability
Learn what server-side template injection is, how SSTI vulnerabilities happen in template engines, why they can lead to data exposure or remote code execution, and how to prevent them with safer template design, isolation, validation, and monitoring.
SQL injection vulnerability
Learn what SQL injection is, how SQLi attacks work, where they appear in web applications, and how to prevent them with parameterized queries, safe database access, and least privilege.
XSS vulnerability
Learn what cross-site scripting is, how XSS vulnerabilities work, where reflected, stored, and DOM-based XSS appear, and how to prevent them with output encoding, sanitization, safe DOM APIs, and defense-in-depth controls.