Cyber Wiki Learning Path
Web Protocol Security
Follow a browser request from URL and method through cookies, browser policy, input processing, server routing, and common web attack paths.
Recommended Sequence
13 connected entries
Clickjacking
Clickjacking overlays or frames a legitimate interface so a user’s visible click lands on a hidden or disguised control, causing an unintended action in the user’s authenticated session.
Application vulnerability class · AdvancedCommand Injection
Command injection occurs when untrusted data is incorporated into an operating-system command or shell expression and changes the command’s intended structure, arguments, control flow, or executed program.
Browser security control · AdvancedContent Security Policy
Content Security Policy is an HTTP response policy that tells supporting browsers which sources and execution patterns are permitted for scripts, styles, images, frames, connections, and other resources, reducing the impact of many content-injection flaws.
Web session-security concept · IntermediateCookies and Web Sessions
Cookies are browser-managed name-value records scoped by domain, path, security attributes, and lifetime; web applications often use them to carry a session identifier that binds requests to server-side authentication and authorization state.
Application security concept · IntermediateCross-Site Request Forgery
Cross-Site Request Forgery is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Application security concept · IntermediateCross-Site Scripting
Cross-Site Scripting is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Web protocol foundation · FoundationalHTTP Methods and Status Codes
HTTP methods express the intended action on a resource, while status codes communicate the outcome; secure applications enforce authorization and state rules for every method and return responses that are accurate without disclosing unnecessary detail.
Network security concept · BeginnerHTTP and HTTPS
HTTP and HTTPS describes how systems exchange, interpret, or protect information across a network. Security depends on both the protocol behavior and the way it is configured, authenticated, monitored, and constrained.
Application vulnerability class · IntermediatePath Traversal
Path traversal occurs when untrusted input influences a file or directory path and allows access outside the application’s intended storage boundary through relative segments, alternate encodings, symbolic links, or platform-specific path behavior.
Application security concept · IntermediateServer-Side Request Forgery
Server-Side Request Forgery is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Cryptography and trust concept · IntermediateTLS Handshake
TLS Handshake is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Web protocol foundation · FoundationalURLs, URIs, and HTTP Request Structure
A URI identifies a resource, a URL adds a method and location for reaching it, and an HTTP request carries a method, target, headers, and optional body that a server interprets within an application and trust context.
Application vulnerability class · AdvancedXML External Entity Processing
XML External Entity risk arises when an XML parser resolves attacker-controlled external entities or related document features, potentially reading local resources, making server-side requests, disclosing data, or consuming excessive resources.