Web Security intermediate
An alert box does not mean a security flaw is low risk
This guide explains why an XSS alert box is a dangerous proof of concept, as it proves attackers can steal session cookies and hijack user accounts silently.
The security knowledge base
How attacks work.
How defenses hold.
About Hacking explains security the way engineers need it explained: mechanism first, mitigation second, sources always. No fear, no folklore — and nothing here requires breaking the law to learn.
Five pillars, one map
-
Security Fundamentals
The mental models everything else is built on.
-
Web Security
How the web gets attacked — and how it holds.
-
Network Security
What actually moves across the wire, and who can touch it.
-
Defense & Hardening
The blue-team playbook: detect, harden, respond.
-
Careers & Practice
Learn legally, prove your skills, get hired.
New to security? Start here
- 01
Learn the mental models
Threat models, attack surface, defense in depth — the vocabulary of the field.
Security Fundamentals - 02
Understand one attack deeply
Work through how cross-site scripting actually executes, then how it is stopped.
Web Security - 03
Practice legally, prove it
CTFs, labs you are allowed to attack, and the credentials that count.
Careers & Practice
Latest articles
Web Security intermediate
The browser padlock does not mean a website is safe
The padlock icon in a web browser shows that encryption is active, but it does not prove a site is secure from attacks or flawed setups like mixed content.
Web Security intermediate
You should use hashing instead of encryption for passwords
Discover why hashing is safer than encryption for passwords. This guide explains one-way functions and how slow hashes protect databases from attackers.
Every article names its author, shows its dates, and cites primary sources. That is the whole trick.
Read the editorial policy