AlgoCademy
Start learning free

CoursesBuild real appsSecurity

Attack your own shop, then close each hole.

For people who have built an API and want to keep it safe. Each lesson gives you a small app with one security hole. The checker runs the attack, and you’re done when the attack fails and honest requests still work.

Start the first lesson See the plans
You type every line A real checker runs your code Nothing to install
Lessons
20
Chapters
3
Language
Python
Level
Advanced
Interview questions
6
Free
The first chapter
Before you start
An API with logins (the Backend path).

Syllabus

01Common Attacks5 lessons
  1. Security Headersfree
  2. Content-Security-Policyfree
  3. Open Redirectsfree
  4. Path Traversal: ../ in a File Namefree
  5. SSRF: The Server Fetches What You Sayfree
02Tokens and Sessions9 lessons
  1. Compare Secrets Safely
  2. Signed Tokens: Check the Signature
  3. Tokens That Expire
  4. Password Reset Tokens
  5. A New Session at Login
  6. CSRF Tokens
  7. Check What Gets Uploaded
  8. Keep Secrets out of Logs
  9. Project: Find the Holes
03Interview Questions6 lessons
  1. One Coupon, Used Twice
  2. A Guessable Token
  3. Passwords Hashed with MD5
  4. A Search That Returns Everything
  5. A Reset Link to the Attacker's Site
  6. Does This Email Have an Account?

Questions

Something else?
team@algocademy.com

Do I attack real sites?

No. Every attack runs against your own small app inside the checker.

More in Build real appsFrontendBackendFull-StackAll courses

LESSON 1

Security Headers

The first chapter is free, no card needed. The rest comes with PRO.

Start the lesson See the plans