Web Hacking Basics
10.0
(43)
Tier 1 Easy Skill Path Web Hacking
Analyze the inner workings of web defense systems and find their gaps. Practice XSS, CSP, CSRF/CORS bypasses, Command Injection, file exploits, Blind SQLi with WAF bypass, DBMS fingerprinting, and NoSQL Injection through Labs.
Web Hacking Basics
10.0
(43)
Tier 1 Easy Skill Path Web Hacking
Analyze the inner workings of web defense systems and find their gaps. Practice XSS, CSP, CSRF/CORS bypasses, Command Injection, file exploits, Blind SQLi with WAF bypass, DBMS fingerprinting, and NoSQL Injection through Labs.
Path Detail
35 hours 50 minutes read
29 courses
12 Labs
12 challenges
12 quizzes
Easy, Easy
Contains machine-translated lectures
0% Completed Total 0 completed
Lecture 0 /29
Excluded
29
Wargame 0 /12
12
Quiz 0 /12
12
You can access locked objectives by upgrading your plan or purchasing the units separately.
The Lab is a practice and is not included in the overall progress.

Why It's Worth Your Time

Today, the web is one of the most essential technologies in our lives. We rely on it for searching information, gaming, shopping, navigation, collaboration, and more. As web services have become more diverse and integral to daily life, ensuring their security has become a critical challenge. If all web services were to go down even for a day, the impact would be unimaginable. This Path is designed to provide the essential knowledge and skills needed to understand web hacking fundamentals and build safer web services. It aims to help beginners — especially those who visit Dreamhack out of curiosity about hacking — enter the world of web security easily.

Topics Covered

  • Step-by-step learning from basic to advanced web hacking
  • Client-side vulnerabilities such as XSS and CSRF
  • Server-side vulnerabilities such as SQL Injection, NoSQL Injection, and SSRF
  • Practical attack scenarios like command injection and file upload/download vulnerabilities

Recommended For

  • Those aiming to become white-hat hackers, bug bounty hunters, security consultants, or researchers
  • Those who want a structured journey from basic to advanced web hacking

Prerequisite Knowledge

  • Basic computer skills
  • Basic understanding of networking
  • Basic knowledge of HTML and JavaScript
  • Familiarity with Python syntax and the Flask framework
Unit Composition
Total 9 units
  1. 1
    Cross-Site Scripting (XSS)
    9.7
    (297)
    Tier 0 Easy
    Cross-Site Scripting (XSS)
    9.7
    (297)
    Tier 0 Easy
    Learn about XSS, a client-side vulnerability, and how to defend against it.
    3 courses 3
    1 Labs 1
    1 quizzes 1
    2 challenges 2
    Cross-Site Scripting (XSS)
    ClientSide: XSS
    Lab: Basic XSS
    Pro
    Quiz: XSS
    [Exercise] XSS
    Exercise: XSS
    xss-1
    [Exercise] XSS-2
    Exercise: XSS-2
    xss-2
  2. 2
    Cross-Site Request Forgery (CSRF)
    9.7
    (204)
    Tier 1 Easy
    100 Coin
    Cross-Site Request Forgery (CSRF)
    9.7
    (204)
    100 Coin
    Tier 1 Easy
    Understand how CSRF, a client-side vulnerability, works, how it differs from XSS, and learn how to defend against it.
    3 courses 3
    1 Labs 1
    1 quizzes 1
    2 challenges 2
    Cross-Site Request Forgery (CSRF)
    ClientSide: CSRF
    Lab: CSRF
    Pro
    Quiz: CSRF
    [Exercise] CSRF
    Exercise: CSRF
    csrf-1
    [Exercise] CSRF-2
    Exercise: CSRF-2
    csrf-2
  3. 3
    Server-Side Request Forgery (SSRF)
    9.8
    (48)
    Tier 1 Easy
    50 Coin
    Server-Side Request Forgery (SSRF)
    9.8
    (48)
    50 Coin
    Tier 1 Easy
    Learn how SSRF, a server-side vulnerability, works and how to defend against it through hands-on exercise.
    2 courses 2
    1 quizzes 1
    1 challenges 1
    Server-Side Request Forgery (SSRF)
    ServerSide: SSRF
    Quiz: SSRF
    [Exercise] Server-Side Request Forgery (SSRF)
    Exercise: SSRF
    web-ssrf
  4. 4
    Access Control
    10.0
    (10)
    Tier 1 Easy
    100 Coin
    Access Control
    10.0
    (10)
    100 Coin
    Tier 1 Easy
    Understand the basic concepts of access control, and learn about various cases of broken access control and how each attack works through hands-on practice.
    3 courses 3
    1 Labs 1
    1 quizzes 1
    2 challenges 2
    Access Control
    Background: Access Control
    Lab: Broken Access Control Basic
    Pro
    Quiz: Access Control
    [Exercise] Horizontal privilege escalation
    Exercise: Horizontal Privilege Escalation
    Access Control 1: Dream NAS
    [Exercise] Vertical privilege escalation
    Exercise: Vertical Privilege Escalation
    Access Control 2: Dream NAS
  5. 5
    Command Injection - Web Servers
    9.9
    (155)
    Tier 1 Easy
    100 Coin
    Command Injection - Web Servers
    9.9
    (155)
    100 Coin
    Tier 1 Easy
    Understand and learn Command Injection techniques and the input characteristics that cause them.
    2 courses 2
    1 Labs 1
    1 quizzes 1
    1 challenges 1
    Command Injection - Web Servers
    ServerSide: Command Injection
    Lab: Command Injection
    Pro
    Quiz: Command Injection
    [Exercise] Command Injection
    Exercise: Command Injection
    command-injection-1
  6. 6
    File Vulnerability - Web Servers
    9.9
    (120)
    Tier 1 Easy
    100 Coin
    File Vulnerability - Web Servers
    9.9
    (120)
    100 Coin
    Tier 1 Easy
    Explore potential security vulnerabilities in file upload and download functionalities of web servers.
    3 courses 3
    1 Labs 1
    1 quizzes 1
    2 challenges 2
    File Vulnerability
    ServerSide: File Vulnerability
    Lab: File Vulnerability
    Pro
    Quiz: File Vulnerability
    [Exercise] File Vulnerability
    Exercise: File Vulnerability
    image-storage
    [Exercise] File Vulnerability-2
    Exercise: File Vulnerability-2
    file-download-1
  7. 7
    SQL Injection
    9.7
    (182)
    Tier 1 Easy
    200 Coin
    SQL Injection
    9.7
    (182)
    200 Coin
    Tier 1 Easy
    Understand SQL Injection and Blind SQL Injection, and their countermeasures through hands-on exercises.
    6 courses 6
    5 Labs 5
    3 quizzes 3
    1 challenges 1
    SQL Injection
    Background: Relational DBMS
    ServerSide: SQL Injection
    Lab: SQL Injection
    Pro
    Quiz: SQL Injection
    SQL DML
    Background: SQL DML
    Lab: SQL DML
    Pro
    Quiz: SQL DML
    SQL Features
    Background: SQL Features
    Lab: Subquery-based SQL Injection
    Pro
    Lab: Blind SQL Injection
    Pro
    Lab: Union-based SQL Injection
    Pro
    Quiz: SQL Features
    [Exercise] SQL Injection
    Exercise: SQL Injection
    Exercise: Blind SQL Injection
    simple_sqli
  8. 8
    NoSQL Injection
    9.8
    (95)
    Tier 1 Easy
    100 Coin
    NoSQL Injection
    9.8
    (95)
    100 Coin
    Tier 1 Easy
    Learn the fundamentals of NoSQL databases and exercise NoSQL Injection attacks and defenses using MongoDB.
    3 courses 3
    1 Labs 1
    1 quizzes 1
    1 challenges 1
    NoSQL Injection
    Background: Non-Relational DBMS
    ServerSide: NoSQL Injection
    Lab: NoSQL Injection
    Pro
    Quiz: NoSQL Injection
    [Exercise] NoSQL Injection
    Exercise: NoSQL Injection
    Mango
  9. 9
    JWT
    0.0
    (0)
    Tier 1 Easy
    JWT
    0.0
    (0)
    Tier 1 Easy
    You'll understand JWT's structure and signature, and learn signature and key manipulation attacks and their defenses.
    4 courses 4
    1 Labs 1
    2 quizzes 2
    Understanding JWT and Digital Signatures
    Background: Token and Digital Signature
    Background: JWT
    JWT and Digital Signature Basics
    Understanding JWT Vulnerabilities and Defenses
    Exploit Tech: alg Manipulation and Defense
    JWT 서명 우회해보기
    Pro
    Exploit Tech: Verification Key Manipulation and Defense
    JWT Vulnerabilities and Defenses
Reviews
10.0 (43)
avatar
user_1234
11 days ago
10

좋아요

dldua12
1 month ago
10

단계별로 학습할 수 있어 좋았습니다. 학습 후 진행되는 워게임으로 문제 풀어볼수있어 좋았습니다

avatar
krepass
3 months ago
10

원래 그냥 야매로만 해킹을 하고 있었어요. 드림핵 강의를 통해 한번 정리하니 두루뭉술하게 알고있던 개념들이 명확해져서 좋았어요. 무엇보다 딴데서 배우려면 어려운 지식들을, 워게임, 실습까지 한번에 모아서 쉽게 배울수 있다는 점이 가장 큰 장점인 것 같아요.

avatar
ffffq Cyborg
4 months ago
10

와! 웹해킹을 공부했어요! 이해하기 쉽게 잘 설명해줘서 일주일도 안되는 짧은 시간 안에 끝냈습니다! 웹해킹 처음 공부하는 사람한테 공부방법 추천하고싶으신분은 이거 추천해주세요! 진짜 정말 도움 많이됩니다!

avatar
keria
4 months ago
10

완벽한 학습 코스였습니다 많이 배우고 갑니다 ! : )

Path Detail
35 hours 50 minutes read
29 courses
12 Labs
12 challenges
12 quizzes
Easy, Easy
Contains machine-translated lectures
0% Completed Total 0 completed
Lecture 0 /29
Excluded
29
Wargame 0 /12
12
Quiz 0 /12
12
You can access locked objectives by upgrading your plan or purchasing the units separately.
The Lab is a practice and is not included in the overall progress.