The Illustrated TLS 1.3 Connection (tls13.xargs.org) · Michael Driscoll
Do: the TLS 1.2 page first, then TLS 1.3.
Every byte of a real HTTPS connection, annotated. It's what "the connection is encrypted" means.
Plans / Plan 04 · A month
Secure what you ship
You end up withYou've read a TLS handshake byte by byte, built the codes in your authenticator app, broken weak cryptography yourself, and exploited the common web vulnerabilities in labs built for it.
- A month
- 4 steps
- from 3 courses
- 3,983 points
The steps
Behind the 6-digit code: Building HOTP and TOTP from scratch (blog.dogac.dev) · Doğaç Eldenk
A small, complete build that uses a real primitive correctly: the one-time codes behind two-factor logins.
The Cryptopals Crypto Challenges (cryptopals.com) · Matasano Security (now NCC Group)
Do: sets 1 to 3.
Breaking weak cryptography yourself, up to a CBC padding-oracle attack, is the fastest cure for rolling your own.
Web Security Academy (portswigger.net) · PortSwigger
Do: SQL injection, cross-site scripting, CSRF, access control and authentication.
Live labs for the vulnerabilities that turn up in ordinary web apps, on sites built to be attacked.
What this plan leaves out
Memory corruption and reverse engineering (most of the security course). They matter for C and systems code, less for a typical web app.
After this
The rest of the Web Security Academy, or the security course from step 1.