Skip to main content
Open source · Free forever

OnlySecurity

An open-source hub for learning security and sharing knowledge.

Real vulnerabilities, real write-ups, real methodology — not a paraphrased course. Start at the fundamentals or jump straight to the write-ups; either way, nothing here is paywalled.

Start Learning →Read the write-ups
6
learning modules
10+
real-world write-ups
100%
free, always
ssrf-bypass.sh
$ curl -s "http://target/fetch?url=http://127.0.0.1/admin"
{"error":"blocked: private range"}

# decimal-encoded IP — same host, different filter path
$ curl -s "http://target/fetch?url=http://2130706433/admin"
{"status":"200 OK"}

One of dozens of real bypass techniques covered in Web Security.

The path

Six modules. One clear order.

Follow it top to bottom if you're new. Already know the basics? Skip straight to what you need.

  1. 01FundamentalsCIA triad, threat modeling, reading a CVE.
  2. 02Web SecurityTrust boundaries and a real testing methodology.
  3. 03OWASP Top 10The standard risk categories, with real scenarios.
  4. 04Network SecurityLayers, segmentation, and core recon tools.
  5. 05Bug BountyScope, recon workflow, reports that get triaged.
OngoingBlog & Write-upsNot a step — read alongside everything above, updated as new work ships.
From the blog

Written from real engagements, not textbooks

How I Found a Chain of Critical Vulnerabilities in a Public Platform’s GraphQL API

A chain of GraphQL vulnerabilities discovered while testing a public application, walked through end to end.

Read on Medium →

Who Needs Admin Rights When You’ve Got Bugs?

A business-logic vulnerability that let low-privilege actions produce admin-level outcomes.

Read on Medium →

Exploit the Game Blindly: With Blind XSS

How a blind XSS payload was used to exfiltrate sensitive information from an internal admin panel.

Read on Medium →
See all write-ups →

Built in the open, on purpose

Every doc, every write-up, every line of this site is a public commit. Found a gap, a bug, or have a write-up worth sharing? Fork it and open a PR — no application, no gatekeeping.

View SourceHow to Contribute