Web challenges: find it, fix it
On web apps in your own lab you find common flaws, then close them by fixing the code or the configuration.
Level 201 · 15 lessons · 0 practice labs
Lessons
Information leaks
- Open directory listing
- A backup forgotten in the web root
- A published .git folder
- A debug page left on in production
- Short task: write the server settings that block these four leaks
Input and output
- SQL injection in a search box and the parameterised query
- Stored XSS in comments and output encoding
- Command injection on a ping page
- An open redirect
- Short task: write a regression test for each flaw you fixed
Sessions and access
- A predictable session cookie
- An endpoint with no authorisation check
- A form without CSRF protection
- A weak password reset flow
- Capstone: find, fix and retest the flaws of a small shop app
About this course
On web apps in your own lab you find common flaws, then close them by fixing the code or the configuration.
What you will learn
- Information leaks
- Input and output
- Sessions and access
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.