Web Security Academy: Free Online Training from Port Swigger
Summary: PortSwigger's Web Security Academy is a free online training center for web application security, with content from its in-house research team and Chief Swig Dafydd Stuttard, author of The Web Application Hacker's Handbook. It pairs written and video material with interactive labs, including featured sets of 30 cross-site scripting labs, 16 SQL injection labs, and 9 XXE injection labs, and it covers indirect prompt injection as a way to manipulate AI-powered web application scanners into unintended actions, data exfiltration, and unauthorized internal requests.
Why it matters: The Academy's own research thread describes indirect prompt injection steering AI-powered web application scanners into exfiltrating sensitive data and making unauthorized internal requests - the same scanners organizations point at their own applications.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026