The objective of the proposed research is to develop a suite of tools to detect, mitigate, and investigate web-based attacks with a primary focus on web-based social engineering attacks. Sophisticated attacks against enterprise networks often unfold through a sequence of steps called the cyber kill chain. As the weakest link in cybersecurity, humans have become the main target of attackers who take advantage of sophisticated web-based social engineering techniques. These attackers leverage low-tier ad networks to inject social engineering components onto web pages to lure users into websites that the attackers control for further exploitation. These exploitations are Web-based Social Engineering Attacks (WSEAs), such as reward and lottery scams. Although researchers have proposed systems and tools to detect some WSEAs, these approaches are tailored to specific scam techniques (i.e., tech support scams, survey scams) only. They were not designed to be effective against a broad set of attack techniques. With the ever-increasing diversity and sophistication of web-based social engineering attacks that any user can encounter, there is an urgent need for new and more effective in-browser systems that can accurately detect generic WSEAs and mitigate the impact of these attacks. This research develops a suite of tools that (1) ensures ease of use, (2) can effectively detect and mitigate WSEAs, and (3) remains robust to the evolution of web-based attack tactics.