Web Security Foundations
From "I have used a browser" to reading a request, changing it on purpose, and finding the first real access-control bug. Free, in order, with a lab for each idea.
- By
- PentestingHere
- Lessons
- 6
- Length
- 145 min
- Published
- 10 Sep 2026
What this path is
A free, ordered walk from "I have used a browser" to "I can read a request, change it on purpose, and understand what the server did with it." Nothing here assumes you have written code or run a scanner. Every lesson ends with something to try on a real target that runs on your machine or in a hosted session.
Who it is for
- Someone who wants to get into bug bounty or penetration testing and keeps bouncing off material that starts at "IDOR".
- A developer who ships web apps and has never watched their own traffic on the wire.
- Anyone who has opened the Academy, picked a lab, and did not know what the first request should be.
The plan
- Web Fundamentals. Networks, the browser, the request, the response. The one lesson everything else stands on. Lab: send every part of a request by hand.
- Your tools. DevTools,
curl, and an intercepting proxy: three ways to see the same traffic, and when to use each. Lab: send a request the browser cannot. - What the browser trusts. HTML, JavaScript, the same-origin policy, and why "it runs in the browser" is not the same as "it runs on the server". Lab: walk around a control that lives only in the page.
- Sessions and identity. Cookies, tokens, and how a server remembers who you are between two requests. Lab: rewrite an unsigned identity cookie and become an admin.
- Your first bug class. Access control and IDOR, the most common first finding. Lab: read another customer's order by changing one number.
- What are you allowed to test? Scope, permission, and testing responsibly. The most important lesson on the path, and the one before you take any of this to a real target.
Most lessons end in a hosted lab you solve in your browser. Do them in order; each one assumes the last. The last lesson has no lab on purpose: its point is knowing what you may and may not touch.
Before you start
You need a browser you can open developer tools in, and a terminal for when you want to try a request outside it. The labs run on our side: press Start and a target of your own is ready in a few seconds. That is all.