Accelerate your cybersecurity career

Build your skills, network, and credibility in one of the most important fields.

Trusted by over 55,000 learners from these fine organizations

Get CompTIA Security+ Certified

We've helped tens of thousands get IT certified and land jobs. Are you next?

Course

Cybr's CompTIA Security+ Preparation Course

Get ready to pass the Security+ exam with our high-quality course (in Early Preview)

Practice Exams

PBQ and Multiple-Choice Practice Exams

We created realistic simulations of what you can expect to see on the exam to help you prepare and to check your readiness. (In Early Preview)

Ebook

Ebook version of the course

Prefer a written study guide of video lessons? We got you. Use our Ebook alone or alongside the course to maximize retention.

Learn Ethical Hacking

High-quality training that focuses on practical skills.

Free

9 Lessons

Beginner’s Guide to sqlmap

Christophe

Learn to use one of the most popular tools to find SQL injection vulnerabilities: sqlmap. In this course, we start out by creating a simple, free, and quick home lab environment with Virtual Box, Kali Linux, and Docker. I'll walk you through step-by-step how to do that, so don't worry if it sounds intimidating! After that, we download and install the latest version of sqlmap. Then, we look at some of the most important and useful features and options for beginners to get started with. Finally, we launch SQL injection attacks against our lab environment in order to extract information from the vulnerable database. sqlmap can be used to extract information such as database schema, database names, table names, password hashes, and more. It even includes a built-in password cracker which we demonstrate by cracking all of the passwords stored in the users table of the database. This course is meant to be easy to follow so that you can quickly learn how to get started with sqlmap. So whether you are interested in becoming a web pentester, or whether you are interested in learning how to make web applications more secure, this course will help you understand what tools and techniques can be used to automate SQL injection attacks and complement manual exploration.
Not Enrolled

42 Lessons

Cross-Site Scripting (XSS): The Practical Guide

Christophe

Description: In this course, you will develop the skills you need to successfully perform and combat Cross-Site Scripting (XSS) attacks. XSS is one of the top 10 most dangerous and common web application attacks according to both OWASP and CWE. I've spent months creating and collecting the best resources on XSS to put them in this course so that you can learn Cross-Site Scripting in a fun, efficient, and practical manner.

In order to truly understand how XSS works and how to defend against it, you have to learn hands-on by executing attacks against vulnerable applications and then looking at secure versions of the same code, and that's exactly what you'll do in this course. We start out by explaining the concepts of XSS and its 3 main types: Reflected, Stored (Persistent), and DOM-based. Then, we take a look at case studies of recent real-world XSS vulnerabilities in Facebook, Gmail, Twitter, Tesla, Airbnb, and TikTok. After that, we spin up a lab environment to perform all 3 types of attacks with both manual and automated approaches. We then set up, configure, and use a powerful browser exploitation framework called BeEF to deliver a payload that hooks unsuspecting browsers. From there, you can launch a number of different attacks using BeEF command modules (ie: scanning internal networks, defacing websites, compromising routers, and more). Next, we apply everything we've learned to pentest the OWASP Juice Shop starting with information gathering, and then exploiting all 3 types of XSS. Finally, we wrap up the course by discussing the most (and least) effective defensive controls, including rules, cheat sheets, and recommended code review techniques to properly defend your applications from this dangerous threat.

If you're looking for a hands-on way to learn Cross-Site Scripting, this is your course!

Testimonials:

"I've got about 3 years in software security with about 23 years in information and DOD security. While I was familiar with XSS I always thought it was a unique and not so dangerous vulnerability. Your course showed me just how damaging XSS could be, and the various ways to assess and mitigate XSS vulnerabilities. I’ll be incorporating your tools and processes in the way I work with teams to evaluate their products." - Matthew H.

"This course is great and I would recommend it to anyone trying to learn about web-pentesting or trying to pursue bug bounty as this course gives you a good basis on XSS with a lot of hands-on work." - Bludger

$19.99
Free

25 Lessons

Injection Attacks: The Free Guide

Christophe

In this course, we explore the biggest risk facing web applications: injections. While we will focus primarily on SQL injections, there are other types of injections such as OS command, LDAP, XPATH, XML, and SMTP header injections, which are all listed in the OWASP Top 10 risks. In order to truly understand how injections work, we have to learn hands-on by executing attacks against vulnerable applications, and that's exactly what we'll do in this course. We start out by setting up safe and legal environments, and then we go on the offense exploring each successful and unsuccessful attack to understand what's going on, and ultimately, how to protect our apps against such vulnerabilities. So if you're looking for hands-on learning, this is your course!
Free

10 Lessons

Introduction to OS Command Injections

Christophe

OS Command Injections are part of the OWASP Top 10 Web Application Security Risks, and as you will see in this course, this threat can result in serious damages if left unchecked. We start out by creating a safe and legal environment for us to perform attacks in. Then, we cover the core concepts of command injections and learn about techniques that can be used to exploit vulnerable targets. After that, we go full-on offensive and perform manual injection attacks as well as automated attacks with a tool called Commix. Once we find vulnerabilities, we generate and plant persistent backdoors that can be exploited to create shells with MSFvenom and Weevely, giving us access to the target server any time we want. After successfully attacking and compromising our targets, we take a step back and discuss defensive controls at the application layer. We also look at actual vulnerable code and show ways of fixing that vulnerable code to prevent injections. Since OS Command injections can be used to exploit most systems running an operating system, such as: web servers, IoT devices, office devices (ie: printers), and more, this is an important threat to understand as an application developer or IT business leader.
Not Enrolled

61 Lessons

The Practical Guide to sqlmap for SQL Injection

Christophe

Description: Learn how to use sqlmap in-depth for professional engagements like pentests or bug bounties. sqlmap is the most powerful and widely used SQL injection tool, and for good reason. It packs an impressive array of features and options specifically crafted to fingerprint, enumerate, and takeover databases as well as underlying systems. In this course, we take a look at all of that. We start by looking at the sqlmap project, including how the source code repository is structured, where to find important files such as configuration and payload files, and how to set up a home lab environment to safely and legally practice what we're learning. Then, we explore every single option that sqlmap offers with examples and explanations of how and when to use the option(s). We learn tips & tricks to see what sqlmap is doing under the hood and to troubleshoot when we come across issues. Once we've covered sqlmap's options and features, we tie it all together by running through scenarios. This is when we get to see how those options can be used together or on their own to achieve our pentest or bug bounty objectives. The course also includes sections dedicated to specific topics such as bypassing WAFs and evading security controls, and how to run sqlmap as an API.

$19.99
Free

15 Lessons

Wireless Deauthentication Attacks

Juan

In this project-based course, you will learn the fundamentals of deauthentication attacks, how to build, program, and use your very own deauther device, and how to defend against this type of attack. You will learn the concepts of deauthentication attacks from both a blue and red team perspective, the exact parts you need to build the same deauther device as shown in the course (for only ~$5 in parts), and how to install the required software on your ESP8266 board. After that, you'll execute your first attacks against devices in your own network. Then, you'll learn what can be done to defend against this type of attack. Finally, you'll see a number of different deauther device examples including a deauther watch and a deauther hidden in plain sight, to inspire you to build your own project and share with the community! This is a fun project that anyone with an appetite to learn can complete from their own home. Enroll for free and let's learn some networking security!

Free

9 Lessons

Beginner’s Guide to sqlmap

Christophe

Learn to use one of the most popular tools to find SQL injection vulnerabilities: sqlmap. In this course, we start out by creating a simple, free, and quick home lab environment with Virtual Box, Kali Linux, and Docker. I'll walk you through step-by-step how to do that, so don't worry if it sounds intimidating! After that, we download and install the latest version of sqlmap. Then, we look at some of the most important and useful features and options for beginners to get started with. Finally, we launch SQL injection attacks against our lab environment in order to extract information from the vulnerable database. sqlmap can be used to extract information such as database schema, database names, table names, password hashes, and more. It even includes a built-in password cracker which we demonstrate by cracking all of the passwords stored in the users table of the database. This course is meant to be easy to follow so that you can quickly learn how to get started with sqlmap. So whether you are interested in becoming a web pentester, or whether you are interested in learning how to make web applications more secure, this course will help you understand what tools and techniques can be used to automate SQL injection attacks and complement manual exploration.
Not Enrolled

42 Lessons

Cross-Site Scripting (XSS): The Practical Guide

Christophe

Description: In this course, you will develop the skills you need to successfully perform and combat Cross-Site Scripting (XSS) attacks. XSS is one of the top 10 most dangerous and common web application attacks according to both OWASP and CWE. I've spent months creating and collecting the best resources on XSS to put them in this course so that you can learn Cross-Site Scripting in a fun, efficient, and practical manner.

In order to truly understand how XSS works and how to defend against it, you have to learn hands-on by executing attacks against vulnerable applications and then looking at secure versions of the same code, and that's exactly what you'll do in this course. We start out by explaining the concepts of XSS and its 3 main types: Reflected, Stored (Persistent), and DOM-based. Then, we take a look at case studies of recent real-world XSS vulnerabilities in Facebook, Gmail, Twitter, Tesla, Airbnb, and TikTok. After that, we spin up a lab environment to perform all 3 types of attacks with both manual and automated approaches. We then set up, configure, and use a powerful browser exploitation framework called BeEF to deliver a payload that hooks unsuspecting browsers. From there, you can launch a number of different attacks using BeEF command modules (ie: scanning internal networks, defacing websites, compromising routers, and more). Next, we apply everything we've learned to pentest the OWASP Juice Shop starting with information gathering, and then exploiting all 3 types of XSS. Finally, we wrap up the course by discussing the most (and least) effective defensive controls, including rules, cheat sheets, and recommended code review techniques to properly defend your applications from this dangerous threat.

If you're looking for a hands-on way to learn Cross-Site Scripting, this is your course!

Testimonials:

"I've got about 3 years in software security with about 23 years in information and DOD security. While I was familiar with XSS I always thought it was a unique and not so dangerous vulnerability. Your course showed me just how damaging XSS could be, and the various ways to assess and mitigate XSS vulnerabilities. I’ll be incorporating your tools and processes in the way I work with teams to evaluate their products." - Matthew H.

"This course is great and I would recommend it to anyone trying to learn about web-pentesting or trying to pursue bug bounty as this course gives you a good basis on XSS with a lot of hands-on work." - Bludger

$19.99
Free

25 Lessons

Injection Attacks: The Free Guide

Christophe

In this course, we explore the biggest risk facing web applications: injections. While we will focus primarily on SQL injections, there are other types of injections such as OS command, LDAP, XPATH, XML, and SMTP header injections, which are all listed in the OWASP Top 10 risks. In order to truly understand how injections work, we have to learn hands-on by executing attacks against vulnerable applications, and that's exactly what we'll do in this course. We start out by setting up safe and legal environments, and then we go on the offense exploring each successful and unsuccessful attack to understand what's going on, and ultimately, how to protect our apps against such vulnerabilities. So if you're looking for hands-on learning, this is your course!
Free

10 Lessons

Introduction to OS Command Injections

Christophe

OS Command Injections are part of the OWASP Top 10 Web Application Security Risks, and as you will see in this course, this threat can result in serious damages if left unchecked. We start out by creating a safe and legal environment for us to perform attacks in. Then, we cover the core concepts of command injections and learn about techniques that can be used to exploit vulnerable targets. After that, we go full-on offensive and perform manual injection attacks as well as automated attacks with a tool called Commix. Once we find vulnerabilities, we generate and plant persistent backdoors that can be exploited to create shells with MSFvenom and Weevely, giving us access to the target server any time we want. After successfully attacking and compromising our targets, we take a step back and discuss defensive controls at the application layer. We also look at actual vulnerable code and show ways of fixing that vulnerable code to prevent injections. Since OS Command injections can be used to exploit most systems running an operating system, such as: web servers, IoT devices, office devices (ie: printers), and more, this is an important threat to understand as an application developer or IT business leader.
Not Enrolled

61 Lessons

The Practical Guide to sqlmap for SQL Injection

Christophe

Description: Learn how to use sqlmap in-depth for professional engagements like pentests or bug bounties. sqlmap is the most powerful and widely used SQL injection tool, and for good reason. It packs an impressive array of features and options specifically crafted to fingerprint, enumerate, and takeover databases as well as underlying systems. In this course, we take a look at all of that. We start by looking at the sqlmap project, including how the source code repository is structured, where to find important files such as configuration and payload files, and how to set up a home lab environment to safely and legally practice what we're learning. Then, we explore every single option that sqlmap offers with examples and explanations of how and when to use the option(s). We learn tips & tricks to see what sqlmap is doing under the hood and to troubleshoot when we come across issues. Once we've covered sqlmap's options and features, we tie it all together by running through scenarios. This is when we get to see how those options can be used together or on their own to achieve our pentest or bug bounty objectives. The course also includes sections dedicated to specific topics such as bypassing WAFs and evading security controls, and how to run sqlmap as an API.

$19.99
Free

15 Lessons

Wireless Deauthentication Attacks

Juan

In this project-based course, you will learn the fundamentals of deauthentication attacks, how to build, program, and use your very own deauther device, and how to defend against this type of attack. You will learn the concepts of deauthentication attacks from both a blue and red team perspective, the exact parts you need to build the same deauther device as shown in the course (for only ~$5 in parts), and how to install the required software on your ESP8266 board. After that, you'll execute your first attacks against devices in your own network. Then, you'll learn what can be done to defend against this type of attack. Finally, you'll see a number of different deauther device examples including a deauther watch and a deauther hidden in plain sight, to inspire you to build your own project and share with the community! This is a fun project that anyone with an appetite to learn can complete from their own home. Enroll for free and let's learn some networking security!

Browse Courses

Explore the courses we have to offer.

Free

9 Lessons

Beginner’s Guide to sqlmap

Christophe

Learn to use one of the most popular tools to find SQL injection vulnerabilities: sqlmap. In this course, we start out by creating a simple, free, and quick home lab environment with Virtual Box, Kali Linux, and Docker. I'll walk you through step-by-step how to do that, so don't worry if it sounds intimidating! After that, we download and install the latest version of sqlmap. Then, we look at some of the most important and useful features and options for beginners to get started with. Finally, we launch SQL injection attacks against our lab environment in order to extract information from the vulnerable database. sqlmap can be used to extract information such as database schema, database names, table names, password hashes, and more. It even includes a built-in password cracker which we demonstrate by cracking all of the passwords stored in the users table of the database. This course is meant to be easy to follow so that you can quickly learn how to get started with sqlmap. So whether you are interested in becoming a web pentester, or whether you are interested in learning how to make web applications more secure, this course will help you understand what tools and techniques can be used to automate SQL injection attacks and complement manual exploration.
Not Enrolled
369 Lessons

CompTIA Security+ SY0-601 Course

Christophe
[Early Preview*][The course is 90% complete] Get ready to pass the CompTIA Security+ SY0-601 with our in-depth, comprehensive, and high-quality course (including 4k video).

Video-only courses are holding you back. Content goes in one ear and out the other. Average videos are also spoken at 150 words per minute, while you're able to read at 250. That's why our courses combine videos with full transcripts. Not only is it a more effective way of learning, but it will help prevent spending hours watching videos to only end up forgetting everything. Retain what you learn with our combined approach and practical studying tips.

The course will cover all 5 domains that you are expected to know in order to pass the exam. This includes:
1. Attacks, Threats, and Vulnerabilities (24%)
2. Architecture and Design (21%)
3. Implementation (25%)
4. Operations and Incident Response (16%)
5. Governance, Risk, and Compliance (14%)
We also include our practice exams when you purchase the course, as well as integrated knowledge checks throughout the course. *Early Preview means that the course is currently in active development and is roughly 90% complete. New content will be added multiple times per week until it is 100% complete which is estimated to be mid-December 2022. You can enroll now and you will receive all updates. Have more questions about the exam? Check out our Security+ FAQ.
$34.99
Not Enrolled

3 Lessons

CompTIA Security+ SY0-601 Practice Exams

Christophe

Practice for the real CompTIA Security+ SY0-601 certification exam with our realistic practice exams. Our exams closely resemble the real exam to provide you with the type of questions and answers that you can expect to see on the exam itself. In fact, we include both types of CompTIA questions: Performance-based questions and Multiple-choice questions.

Performance-based Questions (PBQs): Access multiple PBQs which are designed to test a candidate's ability to solve problems in real-world settings. These are run as simulations for the Security+, so we provide you with interactive testing that closely resembles what you could expect to see on the exam. For example, we provide PBQs that are drag & drop and fill in the blank.

Multiple-choice Questions: Access multiple-choice questions that cover a wide range of topics covered by the real exam. These questions and answers have been carefully crafted by Cybr to verify your knowledge of Domains 1 through 5, which include: Attacks, Threats, and Vulnerabilities; Architecture and Design; Implementation; Operations and Incident Response; Governance, Risk, and Compliance.

Every single question in our practice exam was created by individuals who are CompTIA Security+ SY0-601 certified, which means that they have experienced the exam first-hand and passed it. We know what you're going to go through, so we want you to be as prepared as possible. We even include detailed explanations of the correct and incorrect answers. That way, you continue to learn as you take our practice exams, and you can identify focus points. The exam itself will never contain more than 90 questions but could have fewer, which is why our practice exams include a minimum of 80 questions up to 90 questions, as a combination of PBQs and Multiple Choice.

$14.99
Not Enrolled

42 Lessons

Cross-Site Scripting (XSS): The Practical Guide

Christophe

Description: In this course, you will develop the skills you need to successfully perform and combat Cross-Site Scripting (XSS) attacks. XSS is one of the top 10 most dangerous and common web application attacks according to both OWASP and CWE. I've spent months creating and collecting the best resources on XSS to put them in this course so that you can learn Cross-Site Scripting in a fun, efficient, and practical manner.

In order to truly understand how XSS works and how to defend against it, you have to learn hands-on by executing attacks against vulnerable applications and then looking at secure versions of the same code, and that's exactly what you'll do in this course. We start out by explaining the concepts of XSS and its 3 main types: Reflected, Stored (Persistent), and DOM-based. Then, we take a look at case studies of recent real-world XSS vulnerabilities in Facebook, Gmail, Twitter, Tesla, Airbnb, and TikTok. After that, we spin up a lab environment to perform all 3 types of attacks with both manual and automated approaches. We then set up, configure, and use a powerful browser exploitation framework called BeEF to deliver a payload that hooks unsuspecting browsers. From there, you can launch a number of different attacks using BeEF command modules (ie: scanning internal networks, defacing websites, compromising routers, and more). Next, we apply everything we've learned to pentest the OWASP Juice Shop starting with information gathering, and then exploiting all 3 types of XSS. Finally, we wrap up the course by discussing the most (and least) effective defensive controls, including rules, cheat sheets, and recommended code review techniques to properly defend your applications from this dangerous threat.

If you're looking for a hands-on way to learn Cross-Site Scripting, this is your course!

Testimonials:

"I've got about 3 years in software security with about 23 years in information and DOD security. While I was familiar with XSS I always thought it was a unique and not so dangerous vulnerability. Your course showed me just how damaging XSS could be, and the various ways to assess and mitigate XSS vulnerabilities. I’ll be incorporating your tools and processes in the way I work with teams to evaluate their products." - Matthew H.

"This course is great and I would recommend it to anyone trying to learn about web-pentesting or trying to pursue bug bounty as this course gives you a good basis on XSS with a lot of hands-on work." - Bludger

$19.99
Free

25 Lessons

Injection Attacks: The Free Guide

Christophe

In this course, we explore the biggest risk facing web applications: injections. While we will focus primarily on SQL injections, there are other types of injections such as OS command, LDAP, XPATH, XML, and SMTP header injections, which are all listed in the OWASP Top 10 risks. In order to truly understand how injections work, we have to learn hands-on by executing attacks against vulnerable applications, and that's exactly what we'll do in this course. We start out by setting up safe and legal environments, and then we go on the offense exploring each successful and unsuccessful attack to understand what's going on, and ultimately, how to protect our apps against such vulnerabilities. So if you're looking for hands-on learning, this is your course!
Free

26 Lessons

Introduction to Application Security (AppSec)

Christophe

Description: In this course, we provide a thorough yet high-level understanding of Application Security concepts as they relate to web, mobile, and cloud-based applications. It is intended to provide a foundational overview of core concepts so that you can dive deeper into those respective areas of interest.
Not Enrolled

28 Lessons

Introduction to AWS Security

Christophe

This course is in active development and will be made available December 2022. Be sure to create a free account or register to our newsletter so that we can let you know as soon as it's available!

Coming December 2022
Free

10 Lessons

Introduction to OS Command Injections

Christophe

OS Command Injections are part of the OWASP Top 10 Web Application Security Risks, and as you will see in this course, this threat can result in serious damages if left unchecked. We start out by creating a safe and legal environment for us to perform attacks in. Then, we cover the core concepts of command injections and learn about techniques that can be used to exploit vulnerable targets. After that, we go full-on offensive and perform manual injection attacks as well as automated attacks with a tool called Commix. Once we find vulnerabilities, we generate and plant persistent backdoors that can be exploited to create shells with MSFvenom and Weevely, giving us access to the target server any time we want. After successfully attacking and compromising our targets, we take a step back and discuss defensive controls at the application layer. We also look at actual vulnerable code and show ways of fixing that vulnerable code to prevent injections. Since OS Command injections can be used to exploit most systems running an operating system, such as: web servers, IoT devices, office devices (ie: printers), and more, this is an important threat to understand as an application developer or IT business leader.

Free

9 Lessons

Beginner’s Guide to sqlmap

Christophe

Learn to use one of the most popular tools to find SQL injection vulnerabilities: sqlmap. In this course, we start out by creating a simple, free, and quick home lab environment with Virtual Box, Kali Linux, and Docker. I'll walk you through step-by-step how to do that, so don't worry if it sounds intimidating! After that, we download and install the latest version of sqlmap. Then, we look at some of the most important and useful features and options for beginners to get started with. Finally, we launch SQL injection attacks against our lab environment in order to extract information from the vulnerable database. sqlmap can be used to extract information such as database schema, database names, table names, password hashes, and more. It even includes a built-in password cracker which we demonstrate by cracking all of the passwords stored in the users table of the database. This course is meant to be easy to follow so that you can quickly learn how to get started with sqlmap. So whether you are interested in becoming a web pentester, or whether you are interested in learning how to make web applications more secure, this course will help you understand what tools and techniques can be used to automate SQL injection attacks and complement manual exploration.
Not Enrolled
369 Lessons

CompTIA Security+ SY0-601 Course

Christophe
[Early Preview*][The course is 90% complete] Get ready to pass the CompTIA Security+ SY0-601 with our in-depth, comprehensive, and high-quality course (including 4k video).

Video-only courses are holding you back. Content goes in one ear and out the other. Average videos are also spoken at 150 words per minute, while you're able to read at 250. That's why our courses combine videos with full transcripts. Not only is it a more effective way of learning, but it will help prevent spending hours watching videos to only end up forgetting everything. Retain what you learn with our combined approach and practical studying tips.

The course will cover all 5 domains that you are expected to know in order to pass the exam. This includes:
1. Attacks, Threats, and Vulnerabilities (24%)
2. Architecture and Design (21%)
3. Implementation (25%)
4. Operations and Incident Response (16%)
5. Governance, Risk, and Compliance (14%)
We also include our practice exams when you purchase the course, as well as integrated knowledge checks throughout the course. *Early Preview means that the course is currently in active development and is roughly 90% complete. New content will be added multiple times per week until it is 100% complete which is estimated to be mid-December 2022. You can enroll now and you will receive all updates. Have more questions about the exam? Check out our Security+ FAQ.
$34.99
Not Enrolled

3 Lessons

CompTIA Security+ SY0-601 Practice Exams

Christophe

Practice for the real CompTIA Security+ SY0-601 certification exam with our realistic practice exams. Our exams closely resemble the real exam to provide you with the type of questions and answers that you can expect to see on the exam itself. In fact, we include both types of CompTIA questions: Performance-based questions and Multiple-choice questions.

Performance-based Questions (PBQs): Access multiple PBQs which are designed to test a candidate's ability to solve problems in real-world settings. These are run as simulations for the Security+, so we provide you with interactive testing that closely resembles what you could expect to see on the exam. For example, we provide PBQs that are drag & drop and fill in the blank.

Multiple-choice Questions: Access multiple-choice questions that cover a wide range of topics covered by the real exam. These questions and answers have been carefully crafted by Cybr to verify your knowledge of Domains 1 through 5, which include: Attacks, Threats, and Vulnerabilities; Architecture and Design; Implementation; Operations and Incident Response; Governance, Risk, and Compliance.

Every single question in our practice exam was created by individuals who are CompTIA Security+ SY0-601 certified, which means that they have experienced the exam first-hand and passed it. We know what you're going to go through, so we want you to be as prepared as possible. We even include detailed explanations of the correct and incorrect answers. That way, you continue to learn as you take our practice exams, and you can identify focus points. The exam itself will never contain more than 90 questions but could have fewer, which is why our practice exams include a minimum of 80 questions up to 90 questions, as a combination of PBQs and Multiple Choice.

$14.99
Not Enrolled

42 Lessons

Cross-Site Scripting (XSS): The Practical Guide

Christophe

Description: In this course, you will develop the skills you need to successfully perform and combat Cross-Site Scripting (XSS) attacks. XSS is one of the top 10 most dangerous and common web application attacks according to both OWASP and CWE. I've spent months creating and collecting the best resources on XSS to put them in this course so that you can learn Cross-Site Scripting in a fun, efficient, and practical manner.

In order to truly understand how XSS works and how to defend against it, you have to learn hands-on by executing attacks against vulnerable applications and then looking at secure versions of the same code, and that's exactly what you'll do in this course. We start out by explaining the concepts of XSS and its 3 main types: Reflected, Stored (Persistent), and DOM-based. Then, we take a look at case studies of recent real-world XSS vulnerabilities in Facebook, Gmail, Twitter, Tesla, Airbnb, and TikTok. After that, we spin up a lab environment to perform all 3 types of attacks with both manual and automated approaches. We then set up, configure, and use a powerful browser exploitation framework called BeEF to deliver a payload that hooks unsuspecting browsers. From there, you can launch a number of different attacks using BeEF command modules (ie: scanning internal networks, defacing websites, compromising routers, and more). Next, we apply everything we've learned to pentest the OWASP Juice Shop starting with information gathering, and then exploiting all 3 types of XSS. Finally, we wrap up the course by discussing the most (and least) effective defensive controls, including rules, cheat sheets, and recommended code review techniques to properly defend your applications from this dangerous threat.

If you're looking for a hands-on way to learn Cross-Site Scripting, this is your course!

Testimonials:

"I've got about 3 years in software security with about 23 years in information and DOD security. While I was familiar with XSS I always thought it was a unique and not so dangerous vulnerability. Your course showed me just how damaging XSS could be, and the various ways to assess and mitigate XSS vulnerabilities. I’ll be incorporating your tools and processes in the way I work with teams to evaluate their products." - Matthew H.

"This course is great and I would recommend it to anyone trying to learn about web-pentesting or trying to pursue bug bounty as this course gives you a good basis on XSS with a lot of hands-on work." - Bludger

$19.99
Free

25 Lessons

Injection Attacks: The Free Guide

Christophe

In this course, we explore the biggest risk facing web applications: injections. While we will focus primarily on SQL injections, there are other types of injections such as OS command, LDAP, XPATH, XML, and SMTP header injections, which are all listed in the OWASP Top 10 risks. In order to truly understand how injections work, we have to learn hands-on by executing attacks against vulnerable applications, and that's exactly what we'll do in this course. We start out by setting up safe and legal environments, and then we go on the offense exploring each successful and unsuccessful attack to understand what's going on, and ultimately, how to protect our apps against such vulnerabilities. So if you're looking for hands-on learning, this is your course!
Free

26 Lessons

Introduction to Application Security (AppSec)

Christophe

Description: In this course, we provide a thorough yet high-level understanding of Application Security concepts as they relate to web, mobile, and cloud-based applications. It is intended to provide a foundational overview of core concepts so that you can dive deeper into those respective areas of interest.
Not Enrolled

28 Lessons

Introduction to AWS Security

Christophe

This course is in active development and will be made available December 2022. Be sure to create a free account or register to our newsletter so that we can let you know as soon as it's available!

Coming December 2022
Free

10 Lessons

Introduction to OS Command Injections

Christophe

OS Command Injections are part of the OWASP Top 10 Web Application Security Risks, and as you will see in this course, this threat can result in serious damages if left unchecked. We start out by creating a safe and legal environment for us to perform attacks in. Then, we cover the core concepts of command injections and learn about techniques that can be used to exploit vulnerable targets. After that, we go full-on offensive and perform manual injection attacks as well as automated attacks with a tool called Commix. Once we find vulnerabilities, we generate and plant persistent backdoors that can be exploited to create shells with MSFvenom and Weevely, giving us access to the target server any time we want. After successfully attacking and compromising our targets, we take a step back and discuss defensive controls at the application layer. We also look at actual vulnerable code and show ways of fixing that vulnerable code to prevent injections. Since OS Command injections can be used to exploit most systems running an operating system, such as: web servers, IoT devices, office devices (ie: printers), and more, this is an important threat to understand as an application developer or IT business leader.

What learners say about us

10000 +

Cybr Learners

0 +

Avg Course Rating

"I have to say that these are the most thorough, comprehensive and well-structured courses of study that I have found. Ever. And over the course of the last 3-4 years, I have wasted a lot of money on online courses that turned out to be nothing more than rudimentary demos of this, that, or the other ‘hacking’ technique. Pro Tip: If the course title is something along the lines of ‘Ethical Hacking, The Complete Course’, stay away. Anybody can put together a set of videos and call it a course. But it is rare to find a true subject matter expert who is also a good instructor. And even rarer is it possible to find that combination with a well-structured course of instruction. Such are your courses."

Tom Derenthal

Cybersecurity Analyst

"That was the absolute coolest thing I have done in a while"

Eric Gimbel

Pentester at Tyler Technologies

"This course is so well made. I'm hooked...binge learning SQL injection attacks"

Kripa R.

Cybr student (Injection Attacks)

"Learned about the really useful tools that are out there to strategically incorporate security into web and mobile applications from the very beginning and throughout the SDLC and also how to effectively assess and act on the state of existing applications. I can definitely see myself continuously referring back to these lessons in the future."

Bushra K.

Cybr student (Intro to AppSec)

Overwhelmed? Not sure where to start or go next?

Cybersecurity is an overwhelming field, which is why we’re building a community where everyone is welcome. We structure our online resources so that you can learn step-by-step, and we’re here to help you get started and stay on track.