Here is an uncomfortable truth: modern cryptography is essentially unbreakable, so attackers rarely bother trying. They go around it — through the application. The vast majority of real-world breaches exploit ordinary software flaws, and a handful of them account for most of the damage. The industry's shared checklist is the OWASP Top Ten; here are the ideas behind the most important ones.
The one root cause: mixing data and code
Almost every classic web vulnerability is a variation of a single mistake: taking untrusted input and letting it be interpreted as a trusted command. Keep that lens and the whole list makes sense.
Injection (e.g. SQL injection)
An app builds a database query by gluing user input into a string:
"SELECT * FROM users WHERE name = '" + input + "'"
If the input is '; DROP TABLE users; --, the attacker's text becomes part of the
command, not the data. The fix is to never concatenate: use parameterised
queries so the database treats input strictly as a value, never as SQL. Same idea
defends against command injection, LDAP injection, and their cousins.
Cross-site scripting (XSS)
Now the "command" is JavaScript in the browser. If a site takes user input and
writes it into a page without encoding, an attacker can submit <script>…</script>
that then runs in other users' browsers — stealing their session tokens (the ones
from the last lesson). The fix is output encoding: escape input so it renders as
inert text, plus a Content Security Policy to constrain what scripts can run at
all. (Educatifu's own blog and lesson renderer escapes HTML for exactly this
reason.)
Broken access control
The subtlest of the three: the code authenticates who you are but forgets to check
what you're allowed to do. If viewing your invoice is /invoice/1041 and changing
the number to /invoice/1042 shows someone else's, that's broken access control —
no clever exploit, just a missing check. The fix is to verify authorization on
every request, server-side, for every object.
The mindset: input is untrusted, defence is layered
Notice the common cure: treat all input as untrusted data, never as code, and check authorization everywhere. But a single overlooked input is enough to get in — which is why professionals rely on defence in depth: validate input, parameterise queries, encode output, enforce least privilege, set a strong CSP, log and monitor, and assume any one layer might fail. Security isn't a feature you add; it's a property of the whole system, maintained everywhere at once.
That completes the Core: you can now reason about a system end to end — trust and threats (Foundations), the cryptographic primitives, the TLS channel, authentication, and the application flaws attackers actually use. Advanced and Expert levels build on this toward threat modelling at scale, red-teaming, and running security in production.