Track 7 of 12
Web and application security
How web applications break, and how each break is fixed.
Intermediate 5 lessons Prerequisite: HTTP from the networking track, and some Python or willingness to read it.
The bug classes behind most real breaches, each one shown against a small server you write and run on your own phone. You trace a request end to end, learn why any input you did not create is hostile until proven otherwise, then work through injection, cross-site scripting, broken access control and misconfiguration. Every lesson ends with the fix, not only the flaw.
By the end, you can explain how a request is handled, recognise the common bug classes, and say how each one is prevented.
Lessons in this track
- 01 How a web request is handled Follow a single request end to end, then close the flaw in the path it carries.
- 02 Input you do not control Take a value from the query string, crash a server with it, then validate it properly.
- 03 Injection: when data becomes code Make a server run a command you did not write, then stop it doing that.
- 04 Cross-site scripting Make a search page run your script, then make it show your script as text.
- 05 Broken access control and misconfiguration Ask for another user's record and for the admin area, then make the server say no.