Common Attacks & Defenses (CSRF, XSS, session hijacking, brute force)

36 lessons in Authentication & Authorization

• Password Hashing Cost as Brute Force MitigationFlashcard
• SameSite Cookie Attribute DefenseQuiz
• Double-Submit Cookie PatternQuiz
• Dictionary and Credential Stuffing AttacksFlashcard
• User Enumeration via Login ResponsesFlashcard
• Timing Attacks and Constant-Time ComparisonFlashcard
• Phishing Attacks Against CredentialsFlashcard
• Man-in-the-Middle (MITM) Attack FundamentalsFlashcard
• SQL Injection Attack and DefensesFlashcard
• Replay Attacks and Nonce/Timestamp DefensesFlashcard
• Open Redirect VulnerabilitiesFlashcard
• HTTPS/TLS as Defense Against Sniffing and MITMFlashcard
• What Is CSRFQuiz
• CSRF Token DefenseQuiz
• How CSRF Attacks WorkQuiz
• XSS Leading to Session HijackingFlashcard
• Session Hijacking via Network SniffingFlashcard
• CAPTCHA as Automated Attack DefenseFlashcard
• What is a Brute Force AttackFlashcard
• Content Security Policy as XSS DefenseFlashcard
• Account Lockout PoliciesFlashcard
• Exponential Backoff / Login ThrottlingFlashcard
• Clickjacking and Frame ProtectionsFlashcard
• Rate Limiting as Brute Force DefenseFlashcard
• Stored XSSFlashcard
• What is XSSFlashcard
• Output EncodingFlashcard
• SameSite Cookie AttributeFlashcard
• Reflected XSSFlashcard
• CSRF TokensFlashcard
• How CSRF WorksFlashcard
• DOM-Based XSSFlashcard
• Double-Submit Cookie PatternFlashcard
• Origin/Referer Header ChecksFlashcard
• Input Validation and SanitizationFlashcard
• What is CSRFFlashcard