Web Application Security

About this course

An in-depth look at how modern web applications fail. Working through the most common and impactful vulnerability classes, you will learn how each arises, how to test for it safely in a lab, how to demonstrate impact and how developers can fix it.

What you will learn

• Map the attack surface of a web application
• Test for injection, cross-site scripting and request forgery
• Identify broken authentication and access control
• Find server-side request forgery and insecure deserialisation
• Recommend practical remediations to developers

Curriculum

Lesson content is being written and reviewed. Lessons unlock as they are published.

1. Module 1 · 1 h 10 min

   How the web works for testers

   HTTP, sessions, browsers and the tools of the trade.

   1. HTTP from a tester's perspectiveComing soon
   2. Setting up an intercepting proxyComing soon
   3. Mapping the attack surfaceComing soon
   4. Module 1 knowledge checkComing soon

2. Module 2 · 1 h 5 min

   Injection

   SQL, command and template injection.

   1. SQL injectionComing soon
   2. Command and template injectionComing soon
   3. Module 2 knowledge checkComing soon

3. Module 3 · 1 h

   Client-side attacks

   Cross-site scripting, CSRF and related issues.

   1. Cross-site scriptingComing soon
   2. Cross-site request forgery and clickjackingComing soon
   3. Module 3 knowledge checkComing soon

4. Module 4 · 1 h

   Authentication and access control

   Where most serious web vulnerabilities live.

   1. Authentication weaknessesComing soon
   2. Broken access control and IDORComing soon
   3. Module 4 knowledge checkComing soon

5. Module 5 · 1 h 10 min

   Server-side vulnerabilities

   SSRF, file handling and deserialisation.

   1. Server-side request forgeryComing soon
   2. File upload and path traversalComing soon
   3. Final assessmentComing soon