Ressources

Educational

Learning platforms

• Portswigger Academy: Covers the most important concepts/techniques/vulnerabilites in a beginner-friendly way and has labs to practice. From the developers of Burp Suite (Industry Standard)
• Beyond XSS: Blog, that covers Client-Side vulnerabilities/attacks.
• PicoCTF Learning Guide

Beginner challenges

• PicoCTF

Tools

Essentials

• A browser
• Burp Suite: A proxy to intercept, view and modify HTTP Packages your browser sends and receives.
• A code editor to view provided source code
• Docker and docker-compose to run the challenges locally with ease.

Situational

• webhook.site to have a site, that the admin-bot can send the flag to.
• Python requests to code an automized solution in python.
• PayloadsAllTheThings: A collection of useful payloads for different vulnerabilities.