lylemi/learn-web-hackingStructured study notes covering web hacking fundamentals, common vulnerabilities, penetration testing techniques, and defensive security, with curated tool and resource lists.
This English version is a work in progress. The translated table of contents is intended to help readers find topics, but many pages in the English site may still show the original Chinese text.
The Chinese files under source/ remain the canonical source. English translation work should be maintained in locale/en/LC_MESSAGES/*.po, with terminology kept consistent with locale/en/glossary.md.
After diving into the vast ocean of cybersecurity knowledge, I realized that many topics and concepts are scattered and unorganized. Learning becomes unnecessarily difficult without a well-laid-out structure or guide. After grasping the basics, I attempted to gather and record these concepts, which eventually led to the creation of these notes. I hope they can help readers who are planning to learn web hacking.
Before starting, the question "what is web hacking?" needs to be answered. Web hacking covers a range of topics, including websites, web applications, web services, and more. In other words, web hacking focuses on application security and interactive systems. The necessary knowledge includes network protocols, the properties of network applications, their security risks, and the use of various applications. These categories can be complicated, so the following structure attempts to break down and reorganize the relevant content for easier understanding.
To better understand why the field of web security looks the way it does today, and where each area of study is headed, it is necessary to understand the history and evolution of web applications and network attack and defense technologies. This is the first part of the notes, focusing on the evolution of web technologies and the basics of the security field.
The second part introduces the basics of computer networks. Considering the many branches of databases, web servers, and the rapid evolution of the field, only network protocols are covered here. The skipped parts related to network applications should be understood together with programming languages, web application frameworks, network services, and operating system features.
With this foundation, the focus shifts to more detailed attack and defense topics, such as vulnerability types, programming languages, application characteristics, and their corresponding security issues. This is the third part of the notes. It briefly covers information gathering, common web vulnerabilities, languages and frameworks, and internal network penetration techniques. Cloud technology is also important because it has become a key part of the web world. Whether using public cloud services, private clouds, or container technologies, cloud-related knowledge is becoming increasingly important.
The fourth part returns to the defensive perspective, describing security team building, threat intelligence, risk control, and more detailed technical topics such as honeypots and attribution analysis.
The last part focuses on the introduction and use of applications. It includes recommended applications and resources, along with content that is currently unclassified.
The above is an overall summary of the content, but the reading order is not mandatory. Readers can start from any topic of interest. This compilation can be used both as a full set of notes and as a handbook.
Since the author is also still learning, mistakes or incomplete explanations are inevitable while organizing these notes. Errors will be fixed and information will be added in a timely manner. If you find any mistakes, you are welcome to report or correct them through an Issue or PR. Help is much appreciated.
Many sources were used as references when making these notes, and the corresponding links are listed at the end of each article. Many thanks to the authors for sharing these articles. The online version of these notes can be viewed here.
git clone https://github.com/LyleMi/Learn-Web-Hacking.git
cd Learn-Web-Hacking
pip install -r requirements.txt
make html-zh
make html-en
Questions and suggestions are welcome through issues or pull requests.
For English translation contributions, please treat the Chinese files under source/ as the canonical source. English text should be maintained in locale/en/LC_MESSAGES/*.po rather than by copying or restructuring the source documents. After Chinese source content changes, regenerate gettext templates first, then update the English translation files with sphinx-intl update.
Use locale/en/glossary.md for preferred English terms and consistency rules before translating new sections.
make gettext
make i18n-en
make html-en
Thanks to all who contributed.
Published under the CC0 1.0 license. Click here to view it.
The content of these notes is collected and organized from open source information, and the technologies mentioned are for learning, authorized testing, and other legal scenarios only. For public safety reasons, some content is not included. Readers are requested to comply with the Cybersecurity Law of the People's Republic of China, the Regulations of the People's Republic of China on Computer Software Protection, and other applicable laws and regulations. Do not perform any kind of testing against unauthorized targets.