12 exhaustive articles covering the major web vulnerability classes, mapped to the OWASP Top 10. Every attack shown working against real code, every fix shown closing it.
0 of 12 read
Start anytime
The oldest attack in the book still tops the charts.
The payload runs in someone else's browser, as them.
The #1 vulnerability class by prevalence, and the simplest to introduce.
The browser sends the cookie, the attacker sends the request.
Login is the highest-value target in the entire app.
The data was 'encrypted.' It just wasn't encrypted well.
Nothing was exploited. The defaults just did the attacker's job for them.
You asked the server to fetch a URL. It fetched your internal metadata endpoint.
Trusting a byte stream and trusting a package registry are the same mistake.
The vulnerability isn't in your code. It's in your package.json.
The breach happened three months before anyone noticed.
Every article in this series, collapsed into one audit you can run today.