Languages › JavaScript
JavaScript
Live courseThe language of the browser — and of client-side attacks.
12 modules · 15 lessons published · beginner-friendly
Overview
Almost every web app you'll test runs JavaScript, and the bugs that matter most now live in the client. This course takes you from 'what is a variable' to reading minified bundles, tracing DOM-XSS source-to-sink, understanding framework escape hatches, and chaining prototype-pollution gadgets. Built for a pentester who wants to read and weaponise JS, not ship software.
Why learn JavaScript
- Modern apps are JavaScript-heavy SPAs — you can't test what you can't read.
- Client-side bugs (DOM XSS, prototype pollution, postMessage) live entirely in JS.
- Reading the bundle reveals endpoints, secrets, and hidden routes the UI never shows.
What you'll build
Security applications
- DOM-based XSS discovery and exploitation
- JavaScript bundle analysis and secret extraction
- Prototype pollution and gadget chaining
- Framework security review (React, Angular, Vue)
- Client-side authorization and JWT analysis
Tools built with JavaScript
Full curriculum
1 Programming Fundamentals 4 lessons
How code runs, variables, data types, arrays, objects, operators, conditions, loops, and functions.
2 Core JavaScript 1 lessons
Scope, hoisting, closures, callbacks, arrow functions, destructuring, modules, and strict mode.
3 Browser Fundamentals 1 lessons
Browser architecture, the DOM, BOM, storage, the same-origin policy, and the browser security model.
4 DOM Manipulation 1 lessons
Selectors, events, dynamic HTML, and the unsafe sinks behind DOM XSS.
5 Asynchronous JavaScript 1 lessons
The event loop, promises, async/await, fetch, and API communication.
6 Advanced JavaScript 1 lessons
Prototypes, the prototype chain, this, eval, the Function constructor, and prototype pollution.
7 Modern Frontend Applications 1 lessons
React, Angular, and Vue from a security angle — escape hatches, SSR seams, and state stores.
8 JavaScript Security Deep Dive 1 lessons
The full vulnerability catalogue: XSS family, prototype pollution, CSTI, JWTs, CSP, CORS, postMessage, workers, DOM clobbering, XS-Leaks.
9 Reading Real Applications 1 lessons
Beautifying, source maps, webpack/Vite bundles, secret extraction, and DevTools workflows.
10 Security Automation with JavaScript 1 lessons
Node.js, npm, HTTP requests, and browser automation for recon and analysis tools.
11 Advanced Web Security Research 1 lessons
Browser internals, V8 and SpiderMonkey, execution and memory concepts, and attack chains.
12 Real-World Pentesting Methodology 1 lessons
Complete workflows for SPAs, React/Angular, GraphQL, and API-heavy targets.