⚡
JavaScript for AppSec Engineers
Learn how security issues emerge in JavaScript and TypeScript applications, from client-side attacks and injection flaws to code review of real CVEs.
37 exercises
4 chapters
← All Tracks
Chapter 1
Client-Side Attacks
Start with browser-side vulnerabilities: cross-site request forgery, postMessage exploitation, XSS, CORS bypasses, and filter bypass techniques in JavaScript front-end code.
Chapter 2
Injection & Command Execution
Exploit prototype pollution, then learn to spot SQL injection, command execution, SSTI, and log injection patterns in JavaScript and TypeScript code review.
Recommended: Complete Chapter 1 first
Chapter 3
Files, Paths & Prototypes
Tackle directory traversal, local file read, and prototype pollution vulnerabilities. Exploit path handling flaws in Express and Node.js, then review real CVE patches.
Recommended: Complete Chapters 1 & 2 first
Chapter 4
Auth, Crypto & Application Logic
Review authentication flaws, hardcoded secrets, weak randomness, padding oracles, race conditions, and ReDoS patterns in JavaScript and TypeScript code.
Recommended: Complete all previous chapters
