Web Application Security

Web application security is the practice of protecting websites, web apps and APIs from attacks that exploit flaws in their code, logic or configuration. The most common risks are catalogued in the OWASP Top 10 and include injection, broken access control, cross-site scripting (XSS), security misconfiguration and server-side request forgery (SSRF). Newer risks, such as prompt injection against AI-powered apps, are growing quickly.

This collection brings together Cracking Station’s hands-on web security walkthroughs: exploiting and preventing XSS, abusing race conditions in checkout logic, prompt injection against an AI assistant, and investigating web attacks through log forensics. Each guide explains the vulnerability, how it is exploited in a safe lab, and how developers fix it.

Written by a certified CEH and CEI instructor. Test only applications you own or are authorized to assess.