Web Hacking
9.9
(34)
Tier 1 Easy Skill Path Web Hacking
Learn fundamental vulnerabilities and attack techniques on both the client and server sides through lectures and Labs, and solve wargame challenges to test your understanding. Completing this Path will prepare you for roles in security field.
Web Hacking
9.9
(34)
Tier 1 Easy Skill Path Web Hacking
Learn fundamental vulnerabilities and attack techniques on both the client and server sides through lectures and Labs, and solve wargame challenges to test your understanding. Completing this Path will prepare you for roles in security field.
0% Completed Total 0 completed
Lecture 0 /31
Excluded
31
Wargame 0 /13
13
Quiz 0 /15
15
You can access locked objectives by upgrading your plan or purchasing the units separately.
The Lab is a practice and is not included in the overall progress.

Why It's Worth Your Time

Today, the web is one of the most essential technologies in our lives. We rely on it for searching information, gaming, shopping, navigation, collaboration, and more. As web services have become more diverse and integral to daily life, ensuring their security has become a critical challenge. If all web services were to go down even for a day, the impact would be unimaginable. This Path is designed to provide the essential knowledge and skills needed to understand web hacking fundamentals and build safer web services. It aims to help beginners — especially those who visit Dreamhack out of curiosity about hacking — enter the world of web security easily.

Topics Covered

  • Basic concepts of the web, including HTTP/HTTPS and browser structures
  • Step-by-step learning from basic to advanced web hacking
  • Client-side vulnerabilities such as XSS and CSRF
  • Server-side vulnerabilities such as SQL Injection, NoSQL Injection, and SSRF
  • Practical attack scenarios like command injection and file upload/download vulnerabilities
  • Hands-on experience solving wargame challenges

Recommended For

  • Those aiming to become white-hat hackers, bug bounty hunters, security consultants, or researchers
  • Those who want a structured journey from basic to advanced web hacking

Prerequisite Knowledge

  • Basic computer skills
  • Basic understanding of networking
  • Basic knowledge of HTML and JavaScript
  • Familiarity with Python syntax and the Flask framework
Unit Composition
Total 9 units
  1. 1
    9.8
    (532)
    9.8
    (532)
    Explore the evolution of web communication, protocols, and browser functionalities.
    Web Basics
    Background: Web
    Background: HTTP/HTTPS
    Lab: HTTP Request & Response
    Pro
    Quiz: Web
    Quiz: HTTP/HTTPS
    Web Browser
    Background: Web Browser
    Tools: Browser DevTools
    Quiz: Web Browser
    Quiz: Browser DevTools
    [Exercise] devtools-sources
    Exercise: devtools-sources
    devtools-sources
  2. 2
    9.6
    (416)
    9.6
    (416)
    Understand key web security concepts such as cookies, sessions, SOP, and CORS.
    Cookie & Session
    Background: Cookie & Session
    Lab: Cookie & Session
    Pro
    Quiz: Cookie & Session
    [Exercise] Cookie
    Exercise: Cookie
    cookie
    [Exercise] Cookie & Session
    Exercise: Cookie & Session
    session-basic
    Same-Origin Policy (SOP)
    Mitigation: Same Origin Policy
    Lab: Same Origin Policy
    Pro
    Quiz: Same Origin Policy
  3. 3
    9.6
    (202)
    9.6
    (202)
    Learn about XSS, a client-side vulnerability, and how to defend against it.
    Cross-Site Scripting (XSS)
    ClientSide: XSS
    Lab: Basic XSS
    Pro
    Quiz: XSS
    [Exercise] XSS
    Exercise: XSS
    xss-1
    [Exercise] XSS-2
    Exercise: XSS-2
    xss-2
  4. 4
    9.6
    (139)
    100 Coin
    9.6
    (139)
    100 Coin
    Understand how CSRF, a client-side vulnerability, works, how it differs from XSS, and learn how to defend against it.
    Cross-Site Request Forgery (CSRF)
    ClientSide: CSRF
    Lab: CSRF
    Pro
    Quiz: CSRF
    [Exercise] CSRF
    Exercise: CSRF
    csrf-1
    [Exercise] CSRF-2
    Exercise: CSRF-2
    csrf-2
  5. 5
    9.6
    (132)
    200 Coin
    9.6
    (132)
    200 Coin
    Understand SQL Injection and Blind SQL Injection, and their countermeasures through hands-on exercises.
    SQL Injection
    Background: Relational DBMS
    ServerSide: SQL Injection
    Lab: SQL Injection
    Pro
    Quiz: SQL Injection
    SQL DML
    Background: SQL DML
    Lab: SQL DML
    Pro
    Quiz: SQL DML
    SQL Features
    Background: SQL Features
    Lab: Subquery-based SQL Injection
    Pro
    Lab: Blind SQL Injection
    Pro
    Lab: Union-based SQL Injection
    Pro
    Quiz: SQL Features
    [Exercise] SQL Injection
    Exercise: SQL Injection
    Exercise: Blind SQL Injection
    simple_sqli
  6. 6
    9.8
    (73)
    100 Coin
    9.8
    (73)
    100 Coin
    Learn the fundamentals of NoSQL databases and exercise NoSQL Injection attacks and defenses using MongoDB.
    NoSQL Injection
    Background: Non-Relational DBMS
    ServerSide: NoSQL Injection
    Lab: NoSQL Injection
    Pro
    Quiz: NoSQL Injection
    [Exercise] NoSQL Injection
    Exercise: NoSQL Injection
    Mango
  7. 7
    9.8
    (94)
    100 Coin
    9.8
    (94)
    100 Coin
    Understand and learn Command Injection techniques and the input characteristics that cause them.
    Command Injection - Web Servers
    ServerSide: Command Injection
    Lab: Command Injection
    Pro
    Quiz: Command Injection
    [Exercise] Command Injection
    Exercise: Command Injection
    command-injection-1
  8. 8
    9.9
    (76)
    100 Coin
    9.9
    (76)
    100 Coin
    Explore potential security vulnerabilities in file upload and download functionalities of web servers.
    File Vulnerability
    ServerSide: File Vulnerability
    Lab: File Vulnerability
    Pro
    Quiz: File Vulnerability
    [Exercise] File Vulnerability
    Exercise: File Vulnerability
    image-storage
    [Exercise] File Vulnerability-2
    Exercise: File Vulnerability-2
    file-download-1
  9. 9
    50 Coin
    9.9
    (22)
    50 Coin
    Learn how SSRF, a server-side vulnerability, works and how to defend against it through hands-on exercise.
    Server-Side Request Forgery (SSRF)
    ServerSide: SSRF
    Quiz: SSRF
    [Exercise] Server-Side Request Forgery (SSRF)
    Exercise: SSRF
    web-ssrf
Reviews
9.9 (34)
5 days ago

웹해킹에 대해서 보다 자세히 배울 수 있었고 정보보안 공부에 더욱 흥미가 생길 수 있도록 도와준 시간이었습니다~!!

24 days ago

기초 지식과 개념, 원리를 자연스럽게 알아갈 수 있는 과정입니다. 2번 정도는 반복해서 들어도 좋을 것 같아요!

1 month ago

보안을 어떻게 시작할지 막막했는데, path와 unit이 체계적으로 되어있어서 시작하기 좋았다

2 months ago

본인은 컴퓨터 학과 저학년 학생임. 아직 진로를 못정해서 여러분야를 찍먹해보고 있는데 정보보안 분야는 타 분야에 비해서 정보가 이리저리 흩어져 있는 것을 느낌. 그래서 고민하던 중 에타에서 정보보안 현직자 한 분이 드림핵을 추천해줘서 시작해봄. 1년 starter를 끊긴 했는데 정말 마음에 안 들면 환불 할려 했었음. 근데 생각보다 훨씬 자세하게 잘 알려주는 것을 보고 정보보안 분야에 대해 흥미가 느껴지기 시작함. 웹 해킹 하면서 이론으로만 배웠던 내용들(본인 학교에서는 computer networking topdown approach 책으로 수업함)을 실습하고 관찰해보니 재밌었음. 개인적으로 문제 푸는 재미도 있음. 백준이나 codeforce 같은 알고리즘 사이트에서 문제 푸는 것을 좋아하신다면 추천함.

2 months ago

기본적인 웹 지식들과 문제 풀이에 필요한 정보가 하나의 PATH로 정리되어있어서 체계적이고 쉽게 학습이 가능했다

0% Completed Total 0 completed
Lecture 0 /31
Excluded
31
Wargame 0 /13
13
Quiz 0 /15
15
You can access locked objectives by upgrading your plan or purchasing the units separately.
The Lab is a practice and is not included in the overall progress.