Hacksplaining: Learn Web Security by Breaking Things First

Hacksplaining teaches web security the correct way round: it lets you do the attack first. Before anyone explains what a parameterized query is, you are typing an apostrophe into a login box on a fake site and watching the whole database fall open. The lesson lands in about four seconds and it never really leaves.

What is Hacksplaining?

It is an interactive secure-coding course built around the vulnerabilities that actually take applications down. There are more than forty lessons covering the OWASP Top 10 and beyond, each one budgeted at roughly fifteen to thirty minutes. SQL injection, cross-site scripting, CSRF, broken authentication, path traversal, command injection, broken access control, clickjacking, and a growing set of AI-era problems including prompt injection.

The structure of every lesson is the same and it is why the site works. First, you play the attacker against a simulated vulnerable application embedded in the page. Clickable, no setup, no VM, no Docker, no “first install Burp Suite”. Then it explains the mechanism: what the server was doing with your input, and why it did what you wanted instead of what its author wanted. Then it shows the defense, with code, usually in several languages so the fix is recognizable regardless of your stack.

That order matters more than it sounds. Security training that starts with “always validate your inputs” produces developers who nod, forget, and ship the bug anyway. Security training that starts with you personally stealing an admin session produces developers who remember viscerally what the rule was for.

The tone is unusually calm for the genre. No hoodie stock photos, no fear-selling. It reads like a competent colleague explaining something at a whiteboard, which is presumably why it has picked up a large registered user base and turns up in the onboarding docs of a lot of engineering teams.

Individuals use it free. The company runs a separate paid team product for organizations that need to assign training and track who completed what, which is the standard and reasonable way this kind of thing gets funded.

What can you do with Hacksplaining?

• Exploit a vulnerable app in your browser. Every lesson includes a simulated target you attack yourself, with no local setup.
• Work through the OWASP Top 10. The classics are all here, each as a self-contained lesson you can finish in a coffee break.
• Learn the AI-era attacks. Prompt injection and related failure modes get the same treatment as SQL injection, which is still rare in security training.
• See the fix in your language. Defenses are shown as code, not just principles, across common web stacks.
• Track your progress. A free account remembers which lessons you have completed, which matters once there are forty of them.
• Use it as a team curriculum. The paid tier adds assignment and reporting for organizations, with a trial if you want to evaluate it.
• Browse the reference material. Beyond the lessons there is supporting material worth skimming when you hit an unfamiliar term.

Tips to get the most out of it

Do the exploit properly, don’t skim to the fix. The entire pedagogical trick is that you performed the attack. Reading past it to the code sample turns the site back into documentation, and there is already plenty of documentation.

Start with SQL injection and XSS. They are the canonical two, they explain a huge share of real-world breaches, and every later lesson is easier once you have internalized “data got treated as instructions”.

Do one lesson a day, not ten on a Saturday. Twenty minutes daily for two weeks covers essentially the whole curriculum and you will retain far more of it.

Read the defense section against your own codebase. The moment a fix is on screen, go look at how your project handles that exact thing. Half the time you will find something.

Take the prompt injection lesson even if you think it does not apply to you. If your product touches a language model anywhere, including a support chatbot someone added last quarter, it applies to you.

Keep the attacks on the sandbox. Everything you learn works on real systems, which is the point and also the legal line. Test only what you own or have written permission to test.

If you like Hacksplaining, also try…

• SQL Murder Mystery: learn SQL by solving a crime, the same learn-by-doing philosophy pointed at queries.
• Cover Your Tracks: run a test on your own browser and see exactly how identifiable you are.
• Have I Been Pwned: check which breaches your addresses turned up in, and understand why credential stuffing works.
• Privacy Guides: careful, non-hysterical recommendations for locking down your own setup.

More hands-on skills in Learning & Education, and the defensive side of the internet in Privacy & Security.