The Gap Nobody Talks About in Web Hacking
A few months back I was talking to someone in our Discord who'd been "learning web hacking" for over a year. Watched every YouTube series. Bookmarked every blog post. Could recite the OWASP Top 10 in his sleep.
Then I asked him to look at a real target for ten minutes and just talk through what he saw.
He froze.
Not because he didn't know anything — he knew plenty. He just didn't have a system. No repeatable process for going from "here's a URL" to "here's a finding." Just a pile of disconnected facts he'd absorbed from a hundred different sources, none of which had ever taught him how the pieces fit together.
I think about that conversation a lot, because it's basically the whole reason the vulnerable-web-app tutorials on YouTube don't work for most people. They show you a bug getting exploited. They rarely show you how you would have found it yourself, or what you do with it once you have.
That gap — between "I've watched people hack things" and "I can hack things" — is where most people studying web security get stuck for years.
Two books, one on either side of that gap
Over the last few weeks I finished writing and shipping two books that try to close it from both directions.
Web Application Hacking L1 is for the person who's exactly where that Discord member was — motivated, curious, has picked up fragments, but has never had anyone hand them an actual methodology. It's 200 pages, and every chapter follows the same loop: you learn a concept, you see it in real annotated HTTP requests, you break it yourself in a lab (Juice Shop, DVWA, PortSwigger Academy — nothing sketchy or illegal), and then you see exactly how a developer would fix it. Recon, Burp Suite used properly instead of just installed, the whole OWASP Top 10, API testing, auth attacks, reporting. The idea is you finish it able to run a full assessment on your own, not just describe one.
Web Application Hacking L2 picks up exactly where that leaves off, and honestly it's the book I wish had existed when I was trying to go from "finds the easy bugs" to "finds the bugs that actually pay." 501 pages, 80 chapters, and the whole thing is built around a different mental model — trust boundaries, chained attacks, the stuff scanners can't see because it's not a syntax error, it's a logic flaw. Business logic abuse, IDOR and BOLA at scale, JWT and OAuth attack chains, SSRF into cloud credential theft, request smuggling, secure code review from the defender's side. If L1 teaches you to find vulnerabilities, L2 teaches you to find the ones that separate a $50 payout from a $5,000 one.
Why I wrote it as two books instead of one giant one
I almost didn't split them. But every time I tried to write "the one book that teaches everything," it kept collapsing into two different audiences with two different problems. A beginner reading a chapter on request smuggling is just going to bounce off it. Someone who already knows what a CSRF token is doesn't need forty pages re-explaining HTTP methods.
So — foundation first, then depth. Read L1, actually do the labs (don't skip them, that's where the skill lives, not in the reading), and when basic vulns and Burp Suite stop feeling like new information, L2 is sitting there waiting.
What I actually care about with these
Not to get preachy about it, but the thing I keep coming back to with all of Codelivly's content is that I don't want to sell "trivia." Anyone can memorize what XSS stands for. What actually gets people hired, or gets their bug bounty reports accepted, is a process they can run again and again on a target they've never seen before. That's the whole design principle behind both books — every single vulnerability comes with the theory, the real HTTP traffic, a hands-on lab, and the fix, so you're building both the attacker's instinct and the defender's understanding at the same time.
If you've been stuck in tutorial purgatory the way that guy in our Discord was, L1 is the place to start. If you already know your way around Burp and the basics feel easy now, go straight for L2 — that's where the interesting bugs are.
Both are up on the Codelivly resources store if you want to dig in.
Top comments (0)