ROT HACKERSACADEMYStart learning
Courses05 / SCANNER PRACTICE

Injection & Browser Testing

Exercise every WSHawk injection family against paired secure and vulnerable controls, verify browser execution, and tune scanner confidence.

Practitioner7-9 hours7 lessons7 guided labs
Begin lesson 01 ↗
COURSE SYLLABUS

Do the work in order.

  1. 01
    55 min

    Test SQL injection

    Compare parameterized search with an intentional string-concatenation flaw using error and boolean probes.

  2. 02
    70 min

    Verify reflected and DOM XSS

    Separate reflection from execution and use WSHawk's isolated Playwright verifier for the DOM sink.

  3. 03
    65 min

    Test command and NoSQL injection

    Use WSHawk markers to reveal shell concatenation and document-query operator injection.

  4. 04
    65 min

    Test path traversal, LFI, and XXE

    Exercise filesystem normalization and external-entity controls without accessing a real system file or network service.

  5. 05
    55 min

    Test SSRF with local OAST

    Prove destination filtering and blind-callback evidence using a local interaction ledger.

  6. 06
    55 min

    Test prototype pollution and open redirect

    Inspect dangerous object keys and redirect destinations with deterministic marker payloads.

  7. 07
    60 min

    Tune the scanner, payload evolution, and CVSS

    Control scan scope, Smart Payload Evolution, confidence, duplicates, and scoring across the complete injection catalogue.