Web SecurityWeb Security · Lesson 02

How The Web Works (Attack Surface)

HTTP, requests, cookies, sessions and where bugs actually live.

Video tutorialTrack course · freeCodeCamp
Speed
Next lesson
Watch 00:00 · 2 checkpoints Watch on YouTube More on this topic
Transcript & captions
5/5

Every web attack is ultimately a crafted HTTP request. Understanding the request/response cycle - method, path, headers, body, status, cookies - is what turns guessing into methodical testing.

SurfaceTypical bugs
URL / query paramsIDOR, open redirect, reflected XSS
Form and JSON bodiesInjection, mass assignment
Headers and cookiesSession fixation, host header injection
File uploadsRemote code execution, stored XSS, path traversal
Client-side JSDOM XSS, exposed keys, weak logic
APIsBroken access control, rate limit bypass

Anything the client sends can be modified: parameters, headers, cookies, hidden fields and JavaScript validation. Never trust it.

Knowledge check

0/2 answered

Which part of a request can an attacker control?

Client-side validation is...