# PentesterLab

> Learn Web Hacking and Security Code Review through hands-on exercises

PentesterLab is an interactive cybersecurity training platform focused on web application security and secure code review. The platform offers 700+ hands-on exercises covering real-world vulnerabilities, CVEs, and security concepts. Learners progress through structured badge tracks, from beginner fundamentals to advanced exploitation techniques.

## Introduction

- [Homepage](https://pentesterlab.com): Main landing page with platform overview
- [Exercises](https://pentesterlab.com/exercises): Browse all 700+ hands-on security exercises
- [PRO Subscription](https://pentesterlab.com/pro): Access to all exercises, badges, and certificates ($19.99/month or $199.99/year)
- [Bootcamp](https://pentesterlab.com/bootcamp): Structured self-paced program for beginners entering infosec
- [AppSecSchool](https://pentesterlab.com/appsecschool): Free educational videos on YouTube covering security topics
- [Live Training](https://pentesterlab.com/live-training): Instructor-led web security code review training ($950/session)
- [Blog](https://pentesterlab.com/blog): Weekly security research roundups and technical articles
- [Glossary](https://pentesterlab.com/glossary): 173 security terms with definitions and context
- [Tracks](https://pentesterlab.com/tracks): Language-specific learning paths for Ruby, Python, JavaScript/TypeScript, Go, and Java

## Sitemaps

- [XML Sitemap](https://pentesterlab.com/sitemap.xml): Contains all public & indexable URLs for this website.

## Platform Overview

PentesterLab teaches web security through four pillars:

1. **Learning Through Manual Exploitation**: Students exploit real vulnerabilities hands-on, building deep understanding of how attacks work at the protocol and code level.
2. **Writing Your Own Tooling**: Exercises require writing custom scripts and exploit code rather than relying on automated tools.
3. **Finding Vulnerabilities in Source Code**: Extensive code review content teaches students to identify security flaws by reading source code across multiple languages.
4. **Detailed Video Walkthroughs**: 700+ expert-led videos walk through exercises, concepts, and techniques with multilingual subtitles.

Key platform stats:
- 600+ hands-on labs with real vulnerable applications
- 700+ expert-led video walkthroughs
- 500+ CVE exercises covering real-world vulnerabilities from 2014-2026
- 173 glossary terms with security definitions
- 26 badge tracks for structured progression
- Video subtitles in 8 languages (English, Hindi, Arabic, Spanish, Turkish, French, Chinese, Portuguese) plus auto-generated subtitles in 7 additional languages

## Badge Tracks (Learning Paths)

PentesterLab organizes exercises into badge tracks that provide structured learning progression:

### Foundational Badges
- **Introduction**: Foundational web security concepts for beginners
- **Web Fundamentals**: Core web technology concepts for security professionals
- **Unix**: 35 exercises covering Linux/Unix fundamentals essential for security testing
- **Essential**: 60 core web security exercises covering fundamental vulnerabilities
- **HTTP**: 43 exercises on HTTP protocol, headers, and web server behavior
- **PCAP**: 35 network packet analysis exercises using Wireshark and similar tools
- **Recon**: 27 reconnaissance exercises for information gathering techniques

### Vulnerability-Focused Badges
- **White**: Critical vulnerabilities including Shellshock and JWT basics (6 exercises)
- **Yellow**: CVEs and cryptographic attacks (7 exercises)
- **Blue**: JWT and cryptography deep-dive (11 exercises)
- **Green**: Advanced exploitation scenarios (16 exercises)
- **Orange**: Client-side vulnerabilities and CORS attacks (15 exercises)
- **Brown**: Advanced exploitation techniques (26 exercises)
- **Serialize**: Deserialization attack patterns (5 exercises)
- **Intercept**: Man-in-the-middle attack techniques (5 exercises)
- **Auth**: 25 authentication and authorization bypass exercises
- **Android**: 8 mobile application security exercises
- **CTF**: 6 capture-the-flag style challenges
- **Media**: 20 media processing vulnerability exercises
- **Java Deserialization**: 12 Java deserialization vulnerability exercises

### API Security
- **API**: 41 exercises covering REST API vulnerabilities, authentication flaws, and injection attacks

### Code Review Badges
- **Code Review**: 107 exercises on identifying vulnerabilities in source code
- **Java Code Review**: 73 Java-focused security code review exercises
- **Python Code Review**: 20 Python security analysis exercises
- **Golang Code Review**: 44 Go language code review exercises


## Language-Specific Tracks

Curated learning routes organized by programming language. Each track mixes exploitation, code review, and real vulnerability patterns:

### Ruby Track
- Focus: Code Review + Exploitation for Rails/Ruby applications
- Topics: Rails mass assignment, session serialization, Ruby Marshal deserialization, Devise security, ERB template injection
- URL: [Ruby Track](https://pentesterlab.com/tracks/ruby)

### Python Track
- Focus: Code Review + Exploitation for Python/Django/Flask applications
- Topics: Python pickle deserialization, Django ORM leaks, Jinja2 SSTI, Flask security
- URL: [Python Track](https://pentesterlab.com/tracks/python)

### JavaScript/TypeScript Track
- Focus: Modern web applications and Node.js services
- Topics: Prototype pollution, Express.js vulnerabilities, JWT handling, DOM-based XSS
- URL: [JavaScript/TypeScript Track](https://pentesterlab.com/tracks/javascript-typescript)

### Go Track
- Focus: Go web applications and backend services
- Topics: CORS vulnerabilities in Go, HTTP handler security, Go-specific code review patterns
- URL: [Go Track](https://pentesterlab.com/tracks/go)

### Java Track
- Focus: Enterprise codebases and framework-heavy targets
- Topics: Java deserialization, Spring actuators, OGNL/SpEL injection, Struts vulnerabilities
- URL: [Java Track](https://pentesterlab.com/tracks/java)

### Getting Started Track
- Focus: Free foundations for new users
- Topics: Platform introduction, basic web security concepts, first exercises
- URL: [Getting Started](https://pentesterlab.com/tracks/getting-started)

## Exercise Categories

Exercises cover a wide range of security topics. Each exercise provides a real vulnerable application to exploit:

### Injection Attacks
- **SQL Injection**: From basic to advanced injection techniques (union-based, blind, time-based, stacked queries, ORM leaks)
- **Command Execution**: OS command injection and exploitation
- **Code Execution**: Arbitrary code execution through various vectors
- **LDAP Injection**: LDAP query manipulation attacks
- **NoSQL Injection**: MongoDB and other NoSQL database attacks
- **GraphQL Injection**: GraphQL-specific attack patterns including batching and introspection
- **XPath Injection**: XML path language injection
- **OGNL Injection**: Object-Graph Navigation Language injection (Java/Struts)
- **SpEL Injection**: Spring Expression Language injection
- **Expression Language Injection**: General EL injection attacks
- **Log Injection**: Log file manipulation attacks

### Cross-Site Attacks
- **Cross-Site Scripting (XSS)**: Reflected, stored, DOM-based, mutation XSS, SVG XSS, and polyglot payloads
- **Cross-Site Request Forgery (CSRF)**: Including JSON CSRF techniques
- **Cross-Site Script Inclusion (XSSI)**: Script inclusion attacks
- **CORS Bypass**: Cross-Origin Resource Sharing misconfigurations

### Authentication & Authorization
- **Authentication Bypass**: Various authentication mechanism flaws
- **Authorization Bypass**: Horizontal and vertical privilege escalation
- **JWT Security**: Algorithm confusion, key confusion, KID injection, none algorithm, signature bypass
- **OAuth2**: Authorization code flow, redirect URI manipulation, state parameter attacks, PKCE
- **SAML**: Assertion manipulation, signature wrapping, NameID attacks
- **Session Attacks**: Fixation, hijacking, injection

### Server-Side Attacks
- **Server-Side Request Forgery (SSRF)**: Including blind SSRF
- **Server-Side Template Injection (SSTI)**: Template engine exploitation
- **XML External Entity (XXE)**: Including blind XXE and billion laughs
- **File Inclusion**: Local and remote file inclusion
- **Directory Traversal**: Path traversal attacks
- **Open Redirect**: URL redirection manipulation
- **HTTP Request Smuggling**: Request parsing discrepancy attacks
- **Web Cache Deception/Poisoning**: Cache manipulation attacks
- **DNS Rebinding**: DNS-based attack techniques

### Deserialization
- **Java Deserialization**: ObjectInputStream, ysoserial gadget chains
- **Python Pickle**: Python pickle deserialization attacks
- **Ruby Marshal**: Ruby object deserialization
- **PHP Object Injection**: PHP unserialize attacks
- **Phar Deserialization**: PHP Phar stream wrapper attacks

### Cryptographic Attacks
- **Padding Oracle**: CBC padding oracle attacks
- **CBC Bit Flipping**: Cipher block chaining manipulation
- **ECB Mode Weakness**: Electronic codebook mode exploitation
- **GCM Nonce Reuse**: Galois/Counter Mode attacks
- **Length Extension**: Hash length extension attacks
- **Timing Attacks**: Side-channel timing analysis

### Other Categories
- **Clickjacking**: UI redressing attacks
- **Host Header Injection**: HTTP host header manipulation
- **Race Conditions**: Time-of-check-time-of-use vulnerabilities
- **Mass Assignment**: Object property injection
- **Prototype Pollution**: JavaScript prototype chain manipulation
- **Insecure Data Storage/Transport**: Data protection failures
- **WAF Bypass**: Web Application Firewall evasion techniques
- **Hardcoded Secrets**: Credential and secret exposure
- **Regular Expression DoS**: ReDoS attacks

### CVE Exercises
500+ real-world CVE reproductions for practical learning, covering vulnerabilities from 2014-2026 across popular software and frameworks. Each CVE exercise recreates the actual vulnerable environment so students can understand and exploit the real vulnerability.

## Blog Posts

### Getting Started & Career
- [A Strategy to Land Your First Pentest Job](https://pentesterlab.com/blog/a-strategy-to-land-your-first-pentest-job): Practical advice for breaking into penetration testing
- [10 Common Mistakes Aspiring/New Pentesters Make](https://pentesterlab.com/blog/10-common-mistakes-aspiring-new-pentesters-make): Avoid common pitfalls when starting your security career
- [Advice for New Pentesters](https://pentesterlab.com/blog/advice-for-new-pentesters): Guidance for those new to penetration testing
- [What to Expect from a Security Internship](https://pentesterlab.com/blog/what-to-expect-security-internship): Insights for security interns
- [Pentester vs. Security Researcher: Skills, Career Paths](https://pentesterlab.com/blog/pentester-vs-security-researcher-career-paths): Compare career paths in security
- [6 Questions to Ask When Interviewing for an AppSec Role](https://pentesterlab.com/blog/6-questions-to-ask-when-interviewing-for-an-appsec-role): Interview preparation tips
- [The Interview](https://pentesterlab.com/blog/the-interview): What to expect in security job interviews
- [Writing a Good Resume](https://pentesterlab.com/blog/writing-a-good-resume): Resume tips for security professionals
- [From Developer to AppSec Engineer](https://pentesterlab.com/blog/from-developer-to-appsec-engineer): Career transition guide
- [From Developer to Pentester](https://pentesterlab.com/blog/from-developer-to-pentester): Career transition guide
- [What Is an AppSec Engineer?](https://pentesterlab.com/blog/what-is-an-appsec-engineer): Role definition and responsibilities
- [Should I Go to University?](https://pentesterlab.com/blog/should-i-go-to-university): Education path advice for security careers
- [InfoSec Networking Guide](https://pentesterlab.com/blog/infosec-networking-guide-beyond-tcp-ip): Building professional connections

### Technical Guides
- [The Ultimate Guide to JWT Vulnerabilities and Attacks](https://pentesterlab.com/blog/jwt-vulnerabilities-attacks-guide): Comprehensive JWT security guide
- [How to Securely Design Your JWT Library](https://pentesterlab.com/blog/secure-jwt-library-design): JWT implementation best practices
- [Algorithm Confusion Attacks Against JWT Using ECDSA](https://pentesterlab.com/blog/exploring-algorithm-confusion-attacks-on-jwt-exploiting-ecdsa): Advanced JWT attack techniques
- [The State of JWT Libraries on JWT.io](https://pentesterlab.com/blog/state-of-jwt-io): Security analysis of popular JWT libraries
- [JWT Algorithm Confusion: Code Review Lessons](https://pentesterlab.com/blog/jwt-algorithm-confusion-code-review-lessons): Learning from JWT CVEs
- [Introduction to Secure Code Review](https://pentesterlab.com/blog/introduction-to-secure-code-review): Getting started with code review
- [OWASP Top 10: What It Is and How to Really Use It](https://pentesterlab.com/blog/owasp-top-10-for-appsec-pentesters): Practical OWASP Top 10 guide
- [Hacking with Curl](https://pentesterlab.com/blog/tricks-to-hack-with-curl): HTTP testing and exploitation with curl
- [The Power of Scripting in Web Hacking](https://pentesterlab.com/blog/the-power-of-scripting-in-web-hacking): Automation for security testing
- [Encoding Is Not Magic](https://pentesterlab.com/blog/encoding-is-not-magic): Understanding encoding in security contexts
- [OR 1=1 Is Dying](https://pentesterlab.com/blog/or-1=1-is-dying): Evolution of SQL injection techniques
- [ORM Leak with SQLite3](https://pentesterlab.com/blog/orm-leak-with-sqlite3): ORM-based data leakage
- [Playing Tag with GCM](https://pentesterlab.com/blog/playing-tag-with-gcm): GCM cryptographic attacks
- [Password Reset: Code Review & Pentest Checklist](https://pentesterlab.com/blog/password-reset-code-review-pentest-checklist): Password reset security
- [FreshRSS Bcrypt Truncation Auth Bypass](https://pentesterlab.com/blog/freshrss-bcrypt-truncation-auth-bypass): Real-world vulnerability analysis
- [Killing IDORs in Rails](https://pentesterlab.com/blog/killing-idors-in-rails): Rails-specific IDOR prevention
- [Good Enough: Golang http.ServeFile](https://pentesterlab.com/blog/good-enough-golang-http-ServeFile): Go file serving security
- [Rails Devise Session Invalidation](https://pentesterlab.com/blog/rails-devise-session-invalidation): Session management in Rails
- [Use Docker for Your Pentesting Labs](https://pentesterlab.com/blog/use-docker-for-your-pentesting-labs): Lab environment setup

### Code Review Methodology
- [How to Start Reviewing Code?](https://pentesterlab.com/blog/how-to-start-reviewing-code): Beginning your code review journey
- [Scoping a Security Code Review](https://pentesterlab.com/blog/scoping-security-code-review-guide): Planning effective code reviews
- [The Difference Between Good and Bad Code Reviewers](https://pentesterlab.com/blog/difference-good-bad-code-reviewers): What separates effective reviewers
- [Effective Note-Keeping for Web Security Code Reviews](https://pentesterlab.com/blog/effective-note-keeping-web-security-code-reviews): Documentation during reviews
- [Spotting Discrepancies in Security Code Reviews](https://pentesterlab.com/blog/spotting-discrepancies-in-security-code-reviews): Finding subtle vulnerabilities
- [Why Settle for a Bug When You Can Catch a Swarm?](https://pentesterlab.com/blog/code-review-catch-a-swarm-instead-of-a-bug): Finding vulnerability patterns
- [On Pentesting and Code Review Strategies](https://pentesterlab.com/blog/pentesting-code-review-strategies): Strategic approaches to security testing
- [Beating the Code Review Plateau](https://pentesterlab.com/blog/beating-the-code-review-plateaux): Advancing past intermediate skills
- [Code Review Without Bugs](https://pentesterlab.com/blog/codereview-without-bugs): Learning code review even without finding bugs
- [CVE to Swarm: Case Study CVE-2024-32963](https://pentesterlab.com/blog/cve-to-swarm-case-study-cve-2024-32963): Turning one CVE into pattern detection
- [Engineer Mind: Visualizing Code and Architecture](https://pentesterlab.com/blog/engineer-mind-visualizing-code-and-architecture): Mental models for code review
- [Blogs for Security Code Review](https://pentesterlab.com/blog/blogs-for-security-code-review): Recommended reading resources

### Learning & Skill Development
- [Mastering Hacking Through Deliberate Practice](https://pentesterlab.com/blog/mastering-hacking-skills): Structured approach to skill development
- [5 Essential Activities for Aspiring Web Hackers](https://pentesterlab.com/blog/essential-web-hacker-activities): Key activities for learning web security
- [Don't Let Tools Spoil Your Hacking Education](https://pentesterlab.com/blog/dont-let-tools-spoil-your-hacking-education): Manual skills over automation
- [Embrace the Suck!](https://pentesterlab.com/blog/embrace-the-suck): Perseverance in learning security
- [Reading Between the Lines: A Guide to Thoughtful Learning](https://pentesterlab.com/blog/reading-between-the-lines-security-learning): Deep learning strategies
- [Learn Web Pentesting: Invariants and Feedback Loops](https://pentesterlab.com/blog/invariants-feedback-loops-web-pentesting): Mental models for testing
- [Building Blocks](https://pentesterlab.com/blog/building-blocks): Foundational security concepts
- [Creative Ways to Use PentesterLab](https://pentesterlab.com/blog/creative-ways-to-use-pentesterlab): Platform usage tips
- [Level Up Your Hacker Journey in 2025](https://pentesterlab.com/blog/level-up-your-hacker-journey-in-2025): Annual learning plan
- [Leverage PentesterLab for Bug Bounty](https://pentesterlab.com/blog/leverage-pentesterlab-for-bug-bounty): Bug bounty preparation
- [Leveraging PentesterLab for Application Security Engineers](https://pentesterlab.com/blog/leveraging-pentesterlab-application-security-engineers): AppSec engineer learning paths
- [Learn Recon for Free](https://pentesterlab.com/blog/learn-recon-for-free): Free reconnaissance exercises
- [Learning Security Code Review for Free](https://pentesterlab.com/blog/learning-security-code-review-for-free): Free code review content
- [Easy Capture the Flag Challenges](https://pentesterlab.com/blog/easy-capture-the-flag-challenges): CTF practice guide
- [Demonstrate Hacking Skills Without 0days](https://pentesterlab.com/blog/demonstrate-hacking-skills-without-0dayz): Portfolio building

### Language-Specific Security
- [6 Easy Bugs to Find in Golang Source Code Reviews](https://pentesterlab.com/blog/6-easy-bugs-golang-source-code-review): Common Go vulnerabilities
- [CORS Vulnerabilities in Go](https://pentesterlab.com/blog/golang-cors-vulnerabilities): Go-specific CORS issues
- [Exploring CORS Vulnerabilities in Rust](https://pentesterlab.com/blog/rust-cors-vulnerabilities): Rust CORS patterns
- [Is PHP Really Getting Better?](https://pentesterlab.com/blog/php-security-is-improving): PHP security evolution
- [What Makes a Language More Secure](https://pentesterlab.com/blog/what-makes-a-language-more-secure): Language security comparisons

### AppSec Strategy & Team Building
- [Hiring Your First AppSec Engineer](https://pentesterlab.com/blog/hiring-your-first-appsec-engineer): Building security teams
- [Technical Interview for Your First AppSec Engineer](https://pentesterlab.com/blog/technical-interview-for-your-first-appsec-engineer): Interview process design
- [Security Champions: Scaling AppSec Through Allies](https://pentesterlab.com/blog/security-champions-scaling-appsec-through-allies): Security champion programs
- [AppSec Ratio: Your Strategic North Star](https://pentesterlab.com/blog/appsec-ratio-your-strategic-north-star): AppSec metrics and strategy
- [Tabletop Exercises for AppSec Teams](https://pentesterlab.com/blog/tabletop-exercises-for-appsec-teams): Team training exercises
- [Error-Proofing (Poka-Yoke) in AppSec](https://pentesterlab.com/blog/error-proofing-poka-yoke-in-appsec): Defensive design principles
- [Homogenizing Development for Scalable AppSec](https://pentesterlab.com/blog/homogenizing-development-for-scalable-appsec): Standardization strategies
- [The Hidden Cost of Technology Sprawl in AppSec](https://pentesterlab.com/blog/the-hidden-cost-of-technology-sprawl-in-appsec): Technology management
- [Where to Place Security Controls: Closer Is Better](https://pentesterlab.com/blog/where-to-place-security-controls-closer-is-better): Control placement strategy
- [Understanding Security Assurance in AppSec](https://pentesterlab.com/blog/understanding-security-assurance-in-appsec): Assurance frameworks
- [Invest in QA](https://pentesterlab.com/blog/invest-in-qa): QA and security intersection
- [What Developers Get for Free](https://pentesterlab.com/blog/what-developers-get-for-free): Framework-provided security

### Industry Insights
- [The Certification Trap](https://pentesterlab.com/blog/the-certification-trap): Perspective on security certifications
- [Secure Coding Training Versus Security Code Review Training](https://pentesterlab.com/blog/secure-coding-vs-security-code-review): Training approaches compared
- [Diminishing Value of Secure Coding Training](https://pentesterlab.com/blog/diminishing-value-secure-coding-training): When secure coding training falls short
- [How AI-Generated Code Is Changing Secure Code Review](https://pentesterlab.com/blog/secure-code-review-ai-code): AI impact on code review
- [Vulnerabilities Are Cattle, Not Pets](https://pentesterlab.com/blog/vulnerabilities-are-cattle-not-pets): Vulnerability management philosophy
- [Need for Speed: AI & Security Productivity](https://pentesterlab.com/blog/need-for-speed-ai-security-productivity): AI in security workflows
- [When Code Is Cheap, What Happens to AppSec?](https://pentesterlab.com/blog/when-code-is-cheap-what-happens-to-appsec): Future of AppSec with AI
- [Why Breaking the Build Doesn't Work](https://pentesterlab.com/blog/why-breaking-the-build-doesnt-work): CI/CD security gate critique
- [Why Devs Should Learn Hacking](https://pentesterlab.com/blog/why-devs-should-learn-hacking): Developer security education
- [If It Hurts, Do It More Often: Patching Philosophy](https://pentesterlab.com/blog/if-it-hurts-do-it-more-often-patching-philosophy): Patching strategy
- [Worth Doing Poorly in Security](https://pentesterlab.com/blog/worth-doing-poorly-in-security): Pragmatic security approaches
- [The Criminal Mindset in Security Testing](https://pentesterlab.com/blog/criminal-mindset-in-security-testing): Attacker thinking
- [Security Twins](https://pentesterlab.com/blog/security-twins): Parallel security concepts
- [Do You Care About Exploitability?](https://pentesterlab.com/blog/do-you-care-about-exploitability): Risk assessment approaches
- [Threat Modelling: KISS Method](https://pentesterlab.com/blog/threat-modelling-kiss-method-think-like-attackers): Simple threat modelling
- [Scoping a Pentest](https://pentesterlab.com/blog/scoping-pentest): Pentest engagement scoping
- [Retesting](https://pentesterlab.com/blog/retesting): Verification testing best practices
- [Negative Testing: Finding What Shouldn't Work](https://pentesterlab.com/blog/negative-testing-finding-what-shouldnt-work): Negative test approaches
- [Minimal Changes for Vulnerability Testing](https://pentesterlab.com/blog/minimal-changes-vulnerability-testing): Efficient testing strategies

### Pentesting Methodology
- [Keeping Notes During a Pentest/Security Assessment/Code Review](https://pentesterlab.com/blog/keeping-notes-during-a-pentest-security-assessment-code-review): Note-taking systems
- [How to Keep Your Pentest Team on Top of Their Game](https://pentesterlab.com/blog/how-to-keep-your-pentest-team-on-top-of-their-game): Team development
- [Pentesters to Security Code Reviewers](https://pentesterlab.com/blog/pentesters-to-security-code-reviewers): Skill expansion
- [Security Code Review Training for Developers](https://pentesterlab.com/blog/security-code-review-training-for-developers): Developer-focused training
- [Seven Reasons Not to Start a Bug Bounty Program](https://pentesterlab.com/blog/seven-reasons-not-to-start-a-bug-bounty-program): Bug bounty critique
- [Wasting Time](https://pentesterlab.com/blog/wasting-time): Efficiency in security testing
- [I Don't Need No Proxy](https://pentesterlab.com/blog/i-dont-need-no-proxy): When to use (and not use) proxy tools
- [What You Don't See](https://pentesterlab.com/blog/what-you-dont-see): Hidden attack surfaces
- [Who Do You Trust?](https://pentesterlab.com/blog/who-do-you-trust): Trust boundaries in security
- [Why You Hate Code Review](https://pentesterlab.com/blog/why-you-hate-code-review): Overcoming code review resistance
- [Clever Developers](https://pentesterlab.com/blog/clever-developers): Complexity as a security risk
- [I Considered Harmful](https://pentesterlab.com/blog/i-considered-harmful): Common programming anti-patterns
- [Mitigating Risks of Command Execution in Compromised Directories](https://pentesterlab.com/blog/mitigating-risks-of-command-execution-in-compromised-directories): Command execution defense
- [What Certificates Taught Us About Dependency Management](https://pentesterlab.com/blog/what-certificates-taught-us-about-dependency-management): Dependency security

### User Interviews
- [Interview with Borja Berastegui](https://pentesterlab.com/blog/interview-with-a-pro-user-borja-berastegui): PRO user experience
- [Interview with Pamela O'Shea](https://pentesterlab.com/blog/interview-with-a-pro-user-pamela-oshea): PRO user experience
- [Interview with Robert Kluger](https://pentesterlab.com/blog/interview-with-a-pro-user-robert-kluger): PRO user experience
- [Interview with Wong Wai Tuck](https://pentesterlab.com/blog/interview-with-a-pro-user-wong-wai-tuck): PRO user experience
- [Interview with Ryan Montgomery (0day)](https://pentesterlab.com/blog/interview-with-ryan-montgomery-aka-0day): Security researcher interview

### Research Worth Reading (Weekly Roundups)
PentesterLab publishes weekly "Research Worth Reading" posts curating the best security research, blog posts, and vulnerability disclosures from across the industry. Archives available from mid-2024 to present at: https://pentesterlab.com/blog (search for "research-worth-reading")

### Specific CVE Analysis Posts
- [CVE-2019-5418: WAF Bypass and Caching](https://pentesterlab.com/blog/cve-2019-5418-on-waf-bypass-and-caching): Rails file disclosure
- [CVE-2019-5420 and Defence in Depth](https://pentesterlab.com/blog/cve-2019-5420-and-defence-in-depth): Rails RCE defense
- [Another JWT Algorithm Confusion: CVE-2024-54150](https://pentesterlab.com/blog/another-jwt-algorithm-confusion-cve-2024-54150): JWT vulnerability analysis
- [CVE-2026-23993: HarbourJWT Unknown Alg JWT Bypass](https://pentesterlab.com/blog/cve-2026-23993-harbourjwt-unknown-alg-jwt-bypass): JWT bypass technique
- [Split, Prevent, None: Exploitation of JWT](https://pentesterlab.com/blog/split-prevent-none-exploitation-jwt): JWT attack methodology
- [Nullcon HackIM 2018 Web4: The Fast Way](https://pentesterlab.com/blog/nullcon-hackim-2018-web4-the-fast-way): CTF writeup

## AppSecSchool Videos

Free educational video content covering application security topics:

### Processes & Strategy
- [AppSec Table Top Exercises](https://pentesterlab.com/appsecschool/appsec-table-top-exercises): Running tabletop exercises for security teams
- [The Big AppSec Shift](https://pentesterlab.com/appsecschool/big-appsec-shift): Changes in application security
- [Security Controls](https://pentesterlab.com/appsecschool/controls): Understanding security control design
- [Don't Start a Bug Bounty Program](https://pentesterlab.com/appsecschool/dont-start-a-bug-bounty-program): When bug bounties aren't the answer
- [Error-Proofing with Function Naming](https://pentesterlab.com/appsecschool/error-proofing-with-function-naming): Poka-yoke for code
- [Git Branching Strategies](https://pentesterlab.com/appsecschool/git-branching-strategies): Git workflows for security
- [Handling Bug Bounty Findings](https://pentesterlab.com/appsecschool/handling-bug-bounty-finding): Processing vulnerability reports
- [Helping Your AppSec Team](https://pentesterlab.com/appsecschool/helping-appsec-team): Developer-AppSec collaboration
- [New Framework Security](https://pentesterlab.com/appsecschool/new-framework): Security implications of framework adoption
- [Poka-Yoke in Security](https://pentesterlab.com/appsecschool/poka-yoke): Mistake-proofing techniques
- [The AppSec Ratio](https://pentesterlab.com/appsecschool/ratio): Developer-to-security ratio metrics
- [Security Champions](https://pentesterlab.com/appsecschool/security-champions): Building champion programs
- [Send a PR (Security Pull Requests)](https://pentesterlab.com/appsecschool/send-a-pr): Contributing security fixes
- [Threat Modelling for Developers](https://pentesterlab.com/appsecschool/threat-modelling-for-developers): Developer-accessible threat modelling
- [Writing Security Advisories](https://pentesterlab.com/appsecschool/writing-security-advisories): Advisory writing best practices

### Career & Skills
- [From Dev to AppSec](https://pentesterlab.com/appsecschool/from-dev-to-appsec): Career transition guide
- [From Pentester to AppSec](https://pentesterlab.com/appsecschool/from-pentester-to-appsec): Career transition guide
- [What Is an AppSec Engineer?](https://pentesterlab.com/appsecschool/what-is-an-appsec-engineer): Role overview
- [Pentest vs Bug Bounty](https://pentesterlab.com/appsecschool/pentest-vs-bug-bounty): Comparing security testing approaches

### Technical
- [6 JWT Tips](https://pentesterlab.com/appsecschool/6-jwt-tips): JWT security best practices
- [Why JWT Suck](https://pentesterlab.com/appsecschool/why-jwt-suck): JWT pitfalls and alternatives
- [CVE-2008-1930](https://pentesterlab.com/appsecschool/cve-2008-1930): Historical CVE walkthrough
- [CVE-2021-43798](https://pentesterlab.com/appsecschool/cve-2021-43798): Grafana directory traversal
- [Extract a Patch](https://pentesterlab.com/appsecschool/extract-a-patch): Reverse-engineering patches for vulnerability analysis
- [Get All the Code](https://pentesterlab.com/appsecschool/get-all-the-code): Source code gathering techniques
- [Get All the DNS](https://pentesterlab.com/appsecschool/get-all-the-dns): DNS reconnaissance methods
- [Review a Library](https://pentesterlab.com/appsecschool/review-a-library): Library security review methodology
- [Starting Code Review](https://pentesterlab.com/appsecschool/starting-code-review): Code review fundamentals

## Bootcamp

PentesterLab Bootcamp is a structured self-paced program for beginners entering information security. It covers foundational topics:
- TCP/IP networking fundamentals
- Transport Layer Security (TLS)
- Web hacking and SQL injection basics

URL: [Bootcamp](https://pentesterlab.com/bootcamp)

## Security Glossary

PentesterLab maintains a comprehensive security glossary with 173 terms covering penetration testing, web security, cryptography, and application security concepts. Each term includes a definition and security context.

URL: [Glossary](https://pentesterlab.com/glossary)

### Glossary Terms (A-Z)

- [Advanced Encryption Standard](https://pentesterlab.com/glossary/advanced-encryption-standard)
- [API Key Exposure](https://pentesterlab.com/glossary/api-key-exposure)
- [Arbitrary File Read](https://pentesterlab.com/glossary/arbitrary-file-read)
- [Arbitrary File Write](https://pentesterlab.com/glossary/arbitrary-file-write)
- [Argon2](https://pentesterlab.com/glossary/argon2)
- [Banner Grabbing](https://pentesterlab.com/glossary/banner-grabbing)
- [Bcrypt](https://pentesterlab.com/glossary/bcrypt)
- [Billion Laughs Attack](https://pentesterlab.com/glossary/billion-laughs-attack)
- [Blind SQL Injection](https://pentesterlab.com/glossary/blind-sql-injection)
- [Blind SSRF](https://pentesterlab.com/glossary/blind-ssrf)
- [Blind XXE](https://pentesterlab.com/glossary/blind-xxe)
- [Boolean-Based Blind SQL Injection](https://pentesterlab.com/glossary/boolean-based-blind-sql-injection)
- [Broken Access Control](https://pentesterlab.com/glossary/broken-access-control)
- [Broken Object-Level Authorization](https://pentesterlab.com/glossary/broken-object-level-authorization)
- [Burp Suite](https://pentesterlab.com/glossary/burp-suite)
- [Cache Key Manipulation](https://pentesterlab.com/glossary/cache-key-manipulation)
- [CBC Bit Flipping](https://pentesterlab.com/glossary/cbc-bit-flipping)
- [Certificate Pinning Bypass](https://pentesterlab.com/glossary/certificate-pinning-bypass)
- [Cipher Block Chaining](https://pentesterlab.com/glossary/cipher-block-chaining)
- [Clickjacking](https://pentesterlab.com/glossary/clickjacking)
- [Code Injection](https://pentesterlab.com/glossary/code-injection)
- [Command Injection](https://pentesterlab.com/glossary/command-injection)
- [Content Security Policy](https://pentesterlab.com/glossary/content-security-policy)
- [Cookie Security Flags](https://pentesterlab.com/glossary/cookie-security-flags)
- [Credential Stuffing](https://pentesterlab.com/glossary/credential-stuffing)
- [Cross-Origin Resource Sharing](https://pentesterlab.com/glossary/cross-origin-resource-sharing)
- [Cross-Site Request Forgery](https://pentesterlab.com/glossary/cross-site-request-forgery)
- [Cross-Site Script Inclusion](https://pentesterlab.com/glossary/cross-site-script-inclusion)
- [Cryptographic Nonce](https://pentesterlab.com/glossary/cryptographic-nonce)
- [CSRF Token](https://pentesterlab.com/glossary/csrf-token)
- [CVE](https://pentesterlab.com/glossary/cve)
- [CVSS](https://pentesterlab.com/glossary/cvss)
- [CWE](https://pentesterlab.com/glossary/cwe)
- [Deserialization Gadget Chain](https://pentesterlab.com/glossary/deserialization-gadget-chain)
- [Directory Bruteforcing](https://pentesterlab.com/glossary/directory-bruteforcing)
- [Directory Traversal](https://pentesterlab.com/glossary/directory-traversal)
- [Django ORM Leak](https://pentesterlab.com/glossary/django-orm-leak)
- [DNS Rebinding](https://pentesterlab.com/glossary/dns-rebinding)
- [Document Type Definition](https://pentesterlab.com/glossary/document-type-definition)
- [DOM-Based XSS](https://pentesterlab.com/glossary/dom-based-xss)
- [DOM Clobbering](https://pentesterlab.com/glossary/dom-clobbering)
- [Double Encoding](https://pentesterlab.com/glossary/double-encoding)
- [ECB Mode Weakness](https://pentesterlab.com/glossary/ecb-mode-weakness)
- [ECDSA](https://pentesterlab.com/glossary/ecdsa)
- [EdDSA](https://pentesterlab.com/glossary/eddsa)
- [Exploit Chain](https://pentesterlab.com/glossary/exploit-chain)
- [Exploit Payload](https://pentesterlab.com/glossary/exploit-payload)
- [Expression Language Injection](https://pentesterlab.com/glossary/expression-language-injection)
- [ffuf](https://pentesterlab.com/glossary/ffuf)
- [Fingerprinting](https://pentesterlab.com/glossary/fingerprinting)
- [Gadget Chain](https://pentesterlab.com/glossary/gadget-chain)
- [Galois/Counter Mode](https://pentesterlab.com/glossary/galois-counter-mode)
- [GCM Nonce Reuse](https://pentesterlab.com/glossary/gcm-nonce-reuse)
- [Gobuster](https://pentesterlab.com/glossary/gobuster)
- [Google Dorking](https://pentesterlab.com/glossary/google-dorking)
- [GraphQL Batching Attack](https://pentesterlab.com/glossary/graphql-batching-attack)
- [GraphQL Injection](https://pentesterlab.com/glossary/graphql-injection)
- [GraphQL Introspection](https://pentesterlab.com/glossary/graphql-introspection)
- [Hash Collision](https://pentesterlab.com/glossary/hash-collision)
- [Hashcat](https://pentesterlab.com/glossary/hashcat)
- [HMAC](https://pentesterlab.com/glossary/hmac)
- [Horizontal Privilege Escalation](https://pentesterlab.com/glossary/horizontal-privilege-escalation)
- [HTTP Request Smuggling](https://pentesterlab.com/glossary/http-request-smuggling)
- [Initialization Vector](https://pentesterlab.com/glossary/initialization-vector)
- [Insecure Deserialization](https://pentesterlab.com/glossary/insecure-deserialization)
- [Insecure Direct Object Reference](https://pentesterlab.com/glossary/insecure-direct-object-reference)
- [John the Ripper](https://pentesterlab.com/glossary/john-the-ripper)
- [JSON CSRF](https://pentesterlab.com/glossary/json-csrf)
- [JSON Web Encryption](https://pentesterlab.com/glossary/json-web-encryption)
- [JSON Web Signature](https://pentesterlab.com/glossary/json-web-signature)
- [JSON Web Token](https://pentesterlab.com/glossary/json-web-token)
- [JSONP](https://pentesterlab.com/glossary/jsonp)
- [JWT Algorithm Confusion](https://pentesterlab.com/glossary/jwt-algorithm-confusion)
- [JWT Key Confusion](https://pentesterlab.com/glossary/jwt-key-confusion)
- [JWT KID Injection](https://pentesterlab.com/glossary/jwt-kid-injection)
- [JWT None Algorithm](https://pentesterlab.com/glossary/jwt-none-algorithm)
- [LDAP Injection](https://pentesterlab.com/glossary/ldap-injection)
- [Length Extension Attack](https://pentesterlab.com/glossary/length-extension-attack)
- [Local File Inclusion](https://pentesterlab.com/glossary/local-file-inclusion)
- [Log Poisoning](https://pentesterlab.com/glossary/log-poisoning)
- [Log4j JNDI Injection](https://pentesterlab.com/glossary/log4j-jndi-injection)
- [Man-in-the-Middle](https://pentesterlab.com/glossary/man-in-the-middle)
- [Mass Assignment](https://pentesterlab.com/glossary/mass-assignment)
- [Metasploit](https://pentesterlab.com/glossary/metasploit)
- [Mutation XSS](https://pentesterlab.com/glossary/mutation-xss)
- [Node.js Prototype Pollution](https://pentesterlab.com/glossary/nodejs-prototype-pollution)
- [NoSQL Injection](https://pentesterlab.com/glossary/nosql-injection)
- [Nuclei](https://pentesterlab.com/glossary/nuclei)
- [Null Byte Injection](https://pentesterlab.com/glossary/null-byte-injection)
- [OAuth2](https://pentesterlab.com/glossary/oauth2)
- [OAuth2 Access Token](https://pentesterlab.com/glossary/oauth2-access-token)
- [OAuth2 Authorization Code Flow](https://pentesterlab.com/glossary/oauth2-authorization-code-flow)
- [OAuth2 Authorization Server](https://pentesterlab.com/glossary/oauth2-authorization-server)
- [OAuth2 Predictable State](https://pentesterlab.com/glossary/oauth2-predictable-state)
- [OAuth2 Redirect URI](https://pentesterlab.com/glossary/oauth2-redirect-uri)
- [OAuth2 Refresh Token](https://pentesterlab.com/glossary/oauth2-refresh-token)
- [OAuth2 Resource Server](https://pentesterlab.com/glossary/oauth2-resource-server)
- [OAuth2 State Fixation](https://pentesterlab.com/glossary/oauth2-state-fixation)
- [OAuth2 State Parameter](https://pentesterlab.com/glossary/oauth2-state-parameter)
- [OGNL Injection](https://pentesterlab.com/glossary/ognl-injection)
- [Open Redirect](https://pentesterlab.com/glossary/open-redirect)
- [Out-of-Band SQL Injection](https://pentesterlab.com/glossary/out-of-band-sql-injection)
- [OWASP Top 10](https://pentesterlab.com/glossary/owasp-top-10)
- [OWASP ZAP](https://pentesterlab.com/glossary/owasp-zap)
- [Padding Oracle Attack](https://pentesterlab.com/glossary/padding-oracle-attack)
- [Password Salt](https://pentesterlab.com/glossary/password-salt)
- [Password Spraying](https://pentesterlab.com/glossary/password-spraying)
- [Path Traversal](https://pentesterlab.com/glossary/path-traversal)
- [PBKDF2](https://pentesterlab.com/glossary/pbkdf2)
- [Phar Deserialization](https://pentesterlab.com/glossary/phar-deserialization)
- [PHP](https://pentesterlab.com/glossary/php)
- [PHP Object Injection](https://pentesterlab.com/glossary/php-object-injection)
- [PHP Type Juggling](https://pentesterlab.com/glossary/php-type-juggling)
- [PHP Wrappers](https://pentesterlab.com/glossary/php-wrappers)
- [PKCE](https://pentesterlab.com/glossary/pkce)
- [PKCS7 Padding](https://pentesterlab.com/glossary/pkcs7-padding)
- [Polyglot Payload](https://pentesterlab.com/glossary/polyglot-payload)
- [PostMessage Vulnerability](https://pentesterlab.com/glossary/postmessage-vulnerability)
- [Proof of Concept](https://pentesterlab.com/glossary/proof-of-concept)
- [Prototype Pollution](https://pentesterlab.com/glossary/prototype-pollution)
- [Python Pickle](https://pentesterlab.com/glossary/python-pickle)
- [Race Condition](https://pentesterlab.com/glossary/race-condition)
- [Rails Mass Assignment](https://pentesterlab.com/glossary/rails-mass-assignment)
- [Rails Session Serialization](https://pentesterlab.com/glossary/rails-session-serialization)
- [Rainbow Table](https://pentesterlab.com/glossary/rainbow-table)
- [Reflected XSS](https://pentesterlab.com/glossary/reflected-xss)
- [Remote File Inclusion](https://pentesterlab.com/glossary/remote-file-inclusion)
- [Return-Oriented Programming](https://pentesterlab.com/glossary/return-oriented-programming)
- [RSA Cryptography](https://pentesterlab.com/glossary/rsa-cryptography)
- [Ruby Marshal](https://pentesterlab.com/glossary/ruby-marshal)
- [Same-Origin Policy](https://pentesterlab.com/glossary/same-origin-policy)
- [SAML Assertion](https://pentesterlab.com/glossary/saml-assertion)
- [SAML Identity Provider](https://pentesterlab.com/glossary/saml-identity-provider)
- [SAML NameID](https://pentesterlab.com/glossary/saml-nameid)
- [SAML Request](https://pentesterlab.com/glossary/saml-request)
- [SAML Response](https://pentesterlab.com/glossary/saml-response)
- [SAML Service Provider](https://pentesterlab.com/glossary/saml-service-provider)
- [Scrypt](https://pentesterlab.com/glossary/scrypt)
- [Security Assertion Markup Language](https://pentesterlab.com/glossary/security-assertion-markup-language)
- [Server-Side Request Forgery](https://pentesterlab.com/glossary/server-side-request-forgery)
- [Server-Side Template Injection](https://pentesterlab.com/glossary/server-side-template-injection)
- [Session Fixation](https://pentesterlab.com/glossary/session-fixation)
- [Session Hijacking](https://pentesterlab.com/glossary/session-hijacking)
- [Session Injection](https://pentesterlab.com/glossary/session-injection)
- [SpEL Injection](https://pentesterlab.com/glossary/spel-injection)
- [Spring Actuators](https://pentesterlab.com/glossary/spring-actuators)
- [SQL Injection](https://pentesterlab.com/glossary/sql-injection)
- [SQLMap](https://pentesterlab.com/glossary/sqlmap)
- [Stacked Queries](https://pentesterlab.com/glossary/stacked-queries)
- [Stored XSS](https://pentesterlab.com/glossary/stored-xss)
- [Struts DevMode](https://pentesterlab.com/glossary/struts-devmode)
- [Subdomain Enumeration](https://pentesterlab.com/glossary/subdomain-enumeration)
- [Subdomain Takeover](https://pentesterlab.com/glossary/subdomain-takeover)
- [SVG XSS](https://pentesterlab.com/glossary/svg-xss)
- [Time-Based Blind SQL Injection](https://pentesterlab.com/glossary/time-based-blind-sql-injection)
- [Timing Attack](https://pentesterlab.com/glossary/timing-attack)
- [TLS Stripping](https://pentesterlab.com/glossary/tls-stripping)
- [Unicode Normalization Bypass](https://pentesterlab.com/glossary/unicode-normalization-bypass)
- [Union-Based SQL Injection](https://pentesterlab.com/glossary/union-based-sql-injection)
- [Vertical Privilege Escalation](https://pentesterlab.com/glossary/vertical-privilege-escalation)
- [WAF Bypass](https://pentesterlab.com/glossary/waf-bypass)
- [Web Application Firewall](https://pentesterlab.com/glossary/web-application-firewall)
- [Web Cache Deception](https://pentesterlab.com/glossary/web-cache-deception)
- [Web Cache Poisoning](https://pentesterlab.com/glossary/web-cache-poisoning)
- [Wireshark](https://pentesterlab.com/glossary/wireshark)
- [XML External Entity](https://pentesterlab.com/glossary/xml-external-entity)
- [XML Signature Wrapping](https://pentesterlab.com/glossary/xml-signature-wrapping)
- [XPath Injection](https://pentesterlab.com/glossary/xpath-injection)
- [XS-Leak](https://pentesterlab.com/glossary/xs-leak)
- [XSLT Injection](https://pentesterlab.com/glossary/xslt-injection)
- [XSS](https://pentesterlab.com/glossary/xss)
- [Ysoserial](https://pentesterlab.com/glossary/ysoserial)

## Enterprise & Education

### PentesterLab PRO Enterprise
- URL: [Enterprise](https://pentesterlab.com/pro/enterprise)
- For pentest teams, AppSec teams, and development organizations
- Per-head licensing with custom quotes
- Clients range from boutique pentest teams to Fortune 50 companies
- Features: team progress tracking, custom badge assignments, interview management, job listings

### PentesterLab PRO Education
- URL: [Education](https://pentesterlab.com/pro/education)
- For educational organizations and universities
- Students learn the latest tricks and vulnerabilities through hands-on exercises
- Custom pricing for educational institutions

### Live Training
- URL: [Live Training](https://pentesterlab.com/live-training)
- Instructor-led web security code review training
- Cohort-based with scheduled sessions
- $950 per session
- Zoom-based with calendar integration
- Early-bird pricing available

## Pricing

### Individual PRO Subscription
- **Monthly**: $19.99/month
- **Annual**: $199.99/year (save ~17%)
- **Student**: Discounted 3-month plan
- 15-day money-back guarantee on all plans

### What PRO Includes
- Access to all 700+ exercises and videos
- Video subtitles in 8+ languages
- Certificates of completion for badge tracks
- Structured badge progression system
- Priority support

### Free Content
- Some introductory exercises are free
- All AppSecSchool videos are free on YouTube
- Bootcamp articles are freely accessible
- Security glossary is freely accessible
- Blog posts are freely accessible

## About

PentesterLab was created by Louis Nyffenegger, a security professional with deep expertise in web application security and code review. The platform emphasizes learning through hands-on exploitation of real vulnerabilities rather than theoretical study.

### Social Media & Community
- Twitter/X: [@PentesterLab](https://twitter.com/PentesterLab)
- LinkedIn: [PentesterLab](https://www.linkedin.com/company/pentesterlab/)
- YouTube: [PentesterLab](https://www.youtube.com/@pentesterlab)
- GitHub: [PentesterLab](https://github.com/PentesterLab)
- Discord: PentesterLab community
- Bluesky: PentesterLab
- Facebook: [PentesterLab](https://www.facebook.com/pentesterlab)
- Instagram: PentesterLab
- Twitch: PentesterLab

## Content Notes

- **Weekly Updates**: New exercises and blog posts are added regularly, including weekly "Research Worth Reading" curated roundups
- **PRO Required**: Most exercises require a PRO subscription; some free exercises are available
- **Hands-On Focus**: All exercises involve exploiting real vulnerabilities in controlled environments deployed as Docker containers
- **CVE Coverage**: 500+ CVE exercises covering real-world vulnerabilities from 2014-2026
- **Multi-Language Videos**: Video subtitles available in English, Hindi, Arabic, Spanish, Turkish, French, Chinese, and Portuguese, plus auto-generated subtitles in Ukrainian, Russian, Thai, Italian, Japanese, Vietnamese, and Korean
- **Certificates**: Completion certificates available for badge tracks
- **Money-Back Guarantee**: 15-day refund policy on PRO subscriptions
- **WAF Mode**: Select exercises support Web Application Firewall mode for defensive training
- **Automated Verification**: Many exercises include automated verification to confirm successful exploitation

## Contact

- Website: https://pentesterlab.com
- Private Training: contact@pentesterlab.com
- Twitter/X: @PentesterLab