Tutorials

Hi, here we want to give beginners a kind of help. We will add tutorials here for different types of challenges so you can get an idea of them. After reading one of the tutorials you should be able to solve at least one of our challenges of the specified category. The aim of this site is not to show you how you can devastate homepages or do some real hacking. But it is very important to know how to program secure HTML, JavaScript, Perl or PHP applications.
But now let's start :-)

Weaknesses in Web-Applications is the first tutorial I wrote and I did it to help all the people out there that have problems finding material that helps them to learn the basics of making web-applications more secure. If I have time I will add more and more information to it. The newest version will be available here! If the content of the tutorial changes the version number changes. If I just fix some spelling errors the version stays the same but you can check the date of the last change. If I made any mistakes just write me an email (webmaster at bright-shadows.net),pm me or write a message in the forum!

• Web Bugs v1.0 by theblacksheep+r3d5pik3
• JavaScript password protections by erik, theblacksheep
• General Cracking by Blacklotis
• Weaknesses in Web-Applications v1.7 by theblacksheep

• One-way Web Hacking
• HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics
• Web Application Security Consortium: Threat Classification
• Web Security Glossary
• Frequently Asked Questions on Web Application Security
• Introduction to Database and Application Worms
• Session Fixation Vulnerability in Web-based Applications
• Fingerprinting Port 80 Attacks II
• OWASP Top 10
• Header Based Exploitation
• Fingerprinting Port 80 Attacks I
• Brute-Force Exploitation of Web Application Session IDs
• A Study In Scarlet
• Session Riding
• Cross-Site Request Forgeries
• Real World XSS
• The Anatomy of Cross Site Scripting
• Advanced cross site scripting and client automation
• The Cross Site Scripting FAQ
• Cross-Site Scripting
• Cross-Site Tracing (XST)
• Bypassing JavaScript Filters - The Flash Attack
• Evolution of Cross-Site Scripting Attacks
• Manipulating Microsoft SQL Server Using SQL Injection
• Blind SQL Injection
• Using Binary Search with SQL Injection
• SQL Injection
• More Advanced SQL Injection
• Advanced SQL Injection

• GCC 3.x Stack Layout (german)
• Overwriting the .dtors section
• Buffer Overflows fuer Jedermann (german)
• Exploiting Format String Vulnerabilities
• P49-14 Smashing The Stack For Fun And Profit
• P55-08 The Frame Pointer Overwrite
• Advances in format string exploitation
• Basic Integer Overflows