Skip to main content
Back to course
Log in
Get started
Someone wanted to learn this too, so Grasp built them a personal learning path.
Create your own
Bug bounty hunter learning path
ยท
Module 10
Advanced Web Attacks & API Security
1
Deconstructing JWTs: Header, Payload, and Signature
Analyze the structure of a JSON Web Token (JWT) including its header, payload, and signature.
2
Exploiting JWT Vulnerabilities
Exploit JWT vulnerabilities such as weak secrets, algorithm confusion (`alg=none`), and signature stripping.
3
HTTP Request Smuggling: Bypassing Security Controls
Identify and exploit HTTP Request Smuggling vulnerabilities to bypass security controls and access internal systems.
4
Web Cache Poisoning Exploitation
Identify and exploit web cache poisoning vulnerabilities to serve malicious content to users.
5
OAuth 2.0 Insecurity: Redirects and State Flaws
Exploit OAuth 2.0 implementation flaws such as insecure redirect URIs and state parameter weaknesses.
6
Testing GraphQL for Common Vulnerabilities
Test GraphQL endpoints for common vulnerabilities like information disclosure via introspection and batching attacks.
7
Python Exploit Scripting for Web Vulnerabilities
Use Python to script a proof-of-concept exploit for a discovered web vulnerability.
8
Chaining Web Vulnerabilities for Critical Impact
Chain multiple web vulnerabilities (e.g., SSRF + Command Injection) to achieve a critical impact.
Previous module
Advanced Server-Side Vulnerabilities
Next module
Privilege Escalation & Post-Exploitation