Web Security Foundations

Start here. This path walks from how a request is authorised, through the two bugs you will meet most — broken access control and injection — to your first captured flags. No prior experience assumed.