OtherSelf-paced, hundreds of labs·Free (BSCP exam $99, needs Burp Suite Professional)

PortSwigger Web Security Academy (including Web LLM Attacks)

4.8

The best free web security training on the internet, and its LLM attacks topic is the clearest short introduction to how AI features break web apps. It treats the model as one more untrusted component, which is exactly the right mental model.

What We Liked

Completely free, with real vulnerable labs rather than quizzes
Web LLM attacks topic frames prompt injection as an API and trust boundary problem, the way developers should think about it
Covers indirect prompt injection through emails and web pages, which is where real incidents happen
Written by the research team behind Burp Suite, and it shows in the accuracy
Burp Suite Certified Practitioner exam is only $99 and is fully practical

What Could Be Better

The LLM topic is small compared with the classic topics like SQL injection or access control
No coverage of model level attacks such as data poisoning in practice or adversarial examples
The BSCP exam effectively requires a Burp Suite Professional licence at around $499 a year
Labs push you towards Burp tooling rather than tool-neutral technique

Detailed review

The Web Security Academy is PortSwigger's free training site, and it has been the standard recommendation for learning web application security for years. Each topic is a written explanation followed by labs: deliberately vulnerable apps hosted by PortSwigger that you attack from your own browser, usually with Burp Suite in the middle. You need a free account and nothing else. The reason it belongs on an AI course review site is the Web LLM attacks topic. It covers direct and indirect prompt injection, mapping and abusing the APIs an LLM can call, insecure handling of model output, and leaking sensitive data through the model.

What I like most is the framing. PortSwigger compares abusing an LLM's tools to server side request forgery, and tells you to treat any API the model can reach as if it were public. That single idea does more for developers than a dozen lists of jailbreak prompts, because it moves the fix out of the prompt and into the authorisation layer where it belongs. The labs are short and concrete. You chat with a support bot, work out what functions it can call, and get it to do something it should not, including via content it reads from somewhere else.

The indirect injection labs are the important ones, since a model reading a poisoned product review or email is the realistic threat, not a user typing ignore previous instructions. The limits are about scope. This is web application security, so model level attacks like training data poisoning, membership inference or adversarial examples are mentioned rather than practised. For those you need something like the Hack The Box AI Red Teamer path. The LLM topic is also much smaller than the mature topics, which have dozens of labs each. The Burp Suite Certified Practitioner exam costs $99 per attempt and is a practical four hour test against live apps.

The price is fair, but you realistically need Burp Suite Professional to pass it, which adds around $499 a year. It is respected in application security hiring. My take: this is one of the few vendor training sites I would recommend to people who never intend to buy the product. The LLM content is short, honest and correctly framed. Start there.

[ final ]

The verdict.

If you build or test web apps that call an LLM, do the Web LLM attacks labs this week. They are free and take an afternoon. Then do the access control and SSRF topics, because that is what most LLM attacks turn out to be.