Confidentiality
Only authorised people reach the information.
Attack path: credential abuse, IDOR, weak crypto, data exposure.
Defence: least privilege, encryption, access control, secret hygiene.
The foundation
The CIA Triad
Every attack in the world lands on one of three pillars. Learn to bypass each one, then learn to rebuild it stronger.
Integrity
Data stays correct and untampered.
Attack path: injection, request tampering, race conditions, supply chain.
Defence: validation, signing, immutable audit logs, integrity checks.
Availability
Systems are reachable whenever authorised users need them.
Attack path: resource exhaustion, logic bombs, dependency failure.
Defence: rate limits, quotas, graceful degradation, redundancy.
Hands-on
Practice labs
Each lab is a self-contained simulation. Nothing here touches a real system — and nothing here is theory either.
ConfidentialityBeginner45 min
The Invoice That Wasn't Yours
A billing portal trusts the ID in the URL. Reach another tenant's records, then make that request impossible.
Open labConfidentialityIntermediate60 min
Secrets Left in the Light
A key leaks through a build artefact. Trace it, prove the blast radius, then rebuild secret hygiene.
Open labIntegrityBeginner50 min
The Price Field Lied
A checkout trusts numbers sent by the browser. Change reality, then make the server the only source of truth.
Open lab