See great collection of resources and hacking labs over at portswigger.net/web-security.
Even if I am just starting to learn with their collection, so far I really like it. The part of the content I have seen so far, has high quality and their labs work great. They really take you at the hand and introduce you to some interesting and highly relevant web security topics, step by step. They give you the training wheels, but with their labs, you still have to drive yourself.
There is just this one thing: They expect that those labs are solved with their product Burp Suite. Don't get me wrong, the Burp Suite is a great tool! Go try it, if you don't know about it, the Community Edition is free.
What I like the most about the academy: It is free, but their business model is clear. There is no hidden agenda. They offer a training ground for their product, and expect people to buy it. This is good, because it will ensure quality content.
But, with this repository, I will take another approach: I will solve their challenges (as long as they are not solved faster with ZAP) with self written scripts. I am not aware of any conflicting policy (if there is one, please notify me!). The scripts will probably mostly (if not all?) be written in python.
The main purpose of this repository is personal future reference. But if you find this, and if you find something useful, feel free to use whatever you like.
The code in this repository reflects my own learning curve: It will get the job done, but will be far from perfect. If you feel the need for comments, I would really appreciate them.
I am interested in
- improvements for my solutions
- alternative (probably better) solutions for labs I have tackled myself.
I am not interested in
- new solutions to labs I have not tackled myself.