Web Exploitation SQL Injection: The Complete Guide to UNION and Error-Based Exploitation
A practical guide to UNION-based and error-based SQL injection, payload crafting with information_schema, and blue-team defenses.
owasp
Web Exploitation 
Web Exploitation Local File Inclusion (LFI) Fundamentals: Path Traversal, /etc/passwd, and Filter Bypasses
A practical introduction to Local File Inclusion: path traversal, reading /etc/passwd, null byte tricks, and PHP filter bypasses, plus defenses.
Security Remote File Inclusion (RFI) Fundamentals: From allow_url_include to RCE
Learn how Remote File Inclusion abuses PHP wrappers and allow_url_include to achieve remote code execution, plus blue-team defenses.
Web Exploitation XXE Attacks: Exploiting XML External Entities for File Disclosure and Blind OOB Exfiltration
A practical guide to XML External Entity attacks — DOCTYPE abuse, file disclosure, SSRF, blind/OOB exfiltration, and defense.
Web Exploitation Cross-Site Scripting (XSS): A Practical Primer
A hands-on primer on reflected, stored, and DOM-based XSS, cookie theft, and modern CSP bypass techniques.
Web Exploitation OS Command Injection: From Shell Metacharacters to Blind Exfiltration and Filter Bypass
A practical guide to OS command injection: shell metacharacters, blind techniques, IFS-based filter bypass, and blue-team defenses.
Web Exploitation Path Traversal: Escaping the Web Root with ../, Encoding Tricks, and Null Bytes
A practical guide to directory traversal: dot-dot-slash, encoding bypasses, absolute paths, null bytes, plus blue-team defenses.
Web Exploitation JWT Vulnerabilities and Attacks: alg none, Key Confusion, and kid Injection
A practical guide to exploiting JSON Web Token flaws — alg=none, key confusion, weak secrets, and kid injection — plus defenses.
Web Exploitation CSRF Attacks and Defenses: Forging State-Changing Requests
How Cross-Site Request Forgery hijacks authenticated sessions, with a hands-on PoC and modern token/SameSite defenses.
Web Exploitation Web Cache Poisoning: Weaponizing Unkeyed Input
How attackers turn unkeyed inputs like X-Forwarded-Host into stored XSS via shared caches, and how to defend.
Tools & Defense Burp Suite: A Practical Introduction for Web Application Testing
A hands-on guide to Burp Suite's proxy, Repeater, Intruder, Scanner, and extensions, plus blue-team defenses.