The web security tutorial runs first, ten articles against 42 deliberately vulnerable labs you run on your own machine, from recon to a full exploit chain. Then the task guides: drive a browser session and audit the requests behind it, scope an agent to a target you are authorized to test, and run untrusted code in a box.
A beginner-friendly CTF tutorial: discover hidden endpoints, test object-level authorization, and learn why an unguessable URL is not an access control.
A CTF tutorial: test an endpoint with the least privileged account you hold, and submit a field the signup form never offered.
A beginner-friendly CTF tutorial: decode JSON Web Tokens, bypass a missing signature check, crack a weak HMAC secret, and turn a key identifier into a path traversal.
A beginner-friendly CTF tutorial: turn a broken search query into a database read, then extract secrets when the application reveals only a boolean—or only its response time.
A beginner-friendly CTF tutorial: cross the boundaries between JSON, shells, templates, XML, and stored data.
A beginner-friendly CTF tutorial: make a victim’s browser execute code, send authenticated requests, cross origins, and leak an OAuth authorization code.
A beginner-friendly CTF tutorial: make a server reach internal services, bypass URL filters, preserve encoded paths, overwrite security data, and turn a log file into code.
A beginner-friendly CTF tutorial: control raw request framing, inject headers, poison shared caches, and test commands carried over WebSockets.
A beginner-friendly CTF tutorial: race a balance check, stack valid discounts, predict recovery tokens, extend a hash, skip MFA state, and turn a signed cookie into code execution.
The final h5i tutorial: carry fresh values between requests, turn small findings into a complete compromise, and keep the entire chain reproducible.
One page of h5i websec reference: the capture and replay loop, every --set target, the replay flags, probe values by vulnerability class, and how to read a sweep.
Open an h5i browser session, drive a page by @ref handle, then audit the fail-closed request log its capture proxy wrote before any bytes moved.
Use h5i for an authorized pentest, CTF, or red-team exercise: scope an agent's network access, capture HTTP traffic, map endpoints, replay requests, and preserve evidence.
Create your first h5i sandbox, run an agent inside it, inspect the diff and execution record, then export or apply the result.
Define an h5i profile with an explicit isolation tier, filesystem grants, default-deny networking, and resource limits, then verify it.
Run a dev server and browser inside an h5i box, watch it through a loopback-only viewer, and safely transfer control from agent to human.
Fetch an untrusted pull request into a detached h5i box, build and exercise it, inspect denied activity, and export a review bundle.