Web challenges: advanced
In more complex apps with APIs, authentication flows and server-side requests you find flaws and close them for good.
Level 301 · 15 lessons · 0 practice labs
Lessons
APIs
- Changing a role through mass assignment in an API
- Broken object-level authorisation
- A login endpoint with no rate limit
- GraphQL introspection left open
- Short task: draw up a least-privilege table for the API
Identity and tokens
- JWT algorithm confusion
- A weak JWT signing key
- A loose check on the OAuth redirect URI
- A second factor that can be skipped
- Short task: write safe settings for the token lifecycle
Server side
- A feature that makes requests to internal addresses
- External entities in an XML upload
- User input in the template engine
- An unsafe serialised cookie
- Capstone: close and report the flaw chain of a multi-service app
About this course
In more complex apps with APIs, authentication flows and server-side requests you find flaws and close them for good.
What you will learn
- APIs
- Identity and tokens
- Server side
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.