Web vulnerabilities fundamentals (OWASP)
The main vulnerability classes OWASP highlights and why they happen.
Level 101 · 20 lessons · 17 practice labs
Lessons
Getting started
- The OWASP Top 10 map: vulnerability classes and their causes
- Lab setup: You will set up an isolated lab with a deliberately vulnerable web app on your own computer, and understand why you only ever practise on systems you own.
- Rules of authorised testing: only your own lab app
- Short task: list the lab app’s pages and forms
Injection
- SQL injection basics: You will grasp that SQL injection comes from an app mixing user input into a database query, and learn how to recognise it in logs.
- Error-based and boolean injection: In your own lab you will see how error messages and true/false responses can leak database information, and learn the fixes that prevent it.
- UNION attacks and schema discovery: You will see in the lab how the structure of a database can be exposed through UNION queries, and why the database account should have least privilege.
- OS command injection: You will understand why it is dangerous when an app mixes user input into an operating system command, and how safer code prevents it.
- Short task: prove the injection in the login form and point to the faulty line
Identity, files and the browser
- Authentication bypass: You will see in a lab app why a weakly built login check can be bypassed, and learn the basic rules of solid authentication.
- File inclusion: You will observe in the lab what risks arise when an app takes a file path from the user, and learn to prevent it with an allow-list of files.
- File upload flaws: You will see in the lab why an upload feature is risky when poorly checked, and learn rules for file type, size and storage location.
- Reflected XSS: You will understand that reflected XSS comes from echoing input back into a page unchanged, and learn how output encoding prevents it.
- Broken access control: seeing someone else’s record
- Security misconfiguration: default accounts and verbose error pages
- Short task: mark one example of each of the six vulnerability classes in the lab app
Fixing and verifying
- Outdated components and known vulnerabilities
- How we close each flaw: For each type of flaw in this course you will learn to match the lasting fix: input validation, parameterised queries, output encoding and access checks.
- The habit of retesting a fix
- Capstone: audit a small application: You will audit a fictional company's small web app in the lab within agreed scope, and collect the flaws you find and your recommended fixes in a short report.
Practice labs
- A quote error in the login form: Find the database error the login form returns for a single quote, point to the line that causes it and hide the error detail from users.
- A true-false difference in the product list: Prove that true and false conditions give different results on the product list's category parameter and make the query parameterised.
- Table names leaking through UNION in the search box: Show in your lab that the search box can leak schema information, fix the query and prove the same request now returns nothing.
- Blind injection in a form with no error messages: Confirm injection in a password reset form that shows no errors by response differences, fix the code and write a log search that catches these attempts.
- Command injection in a ping tool: Prove the admin panel's ping tool passes input to the shell and restrict the input with an IP address allow list.
- File inclusion in a language picker: Prove the language parameter makes the server read another file and bind the parameter to a fixed list of languages.
- An upload form that trusts the extension: Show the avatar upload form only checks the extension and fix it with content checks and storage outside the web root.
- Two flaws in one endpoint: command and path: Find both command injection and path traversal in a backup download endpoint, close them together and produce two separate retest proofs.
- A default admin password left in place: Show that the default account still works on the lab app's admin panel, disable it and force a password change on first setup.
- Change the number in the address bar: someone else's invoice: Prove that changing the number on the invoice page opens another customer's invoice and add an ownership check.
- A detailed error page leaks versions: Find the framework and database versions leaking on a page left in debug mode, turn the mode off and add a generic error page.
- Reaching a hidden admin page as a normal user: Find an admin page hidden from the menu but open to normal users, add a server-side role check and log the refused access.
- Reflected XSS in a comment preview: Prove with a harmless marker that the comment preview reflects input unencoded and fix the output with HTML encoding.
- A stored name field on the profile page: Show a harmless marker written to the profile name field runs as code on other users' pages and encode the output.
- Name the flaw class: six short examples: Match six request-response samples from the lab app to the right flaw class and write a one-sentence fix for each.
- Find and upgrade an outdated library: Find the component version with a known flaw in the lab app, upgrade it to a safe version and test that the app still works.
- Mini audit: three flaws across six classes: Find one flaw from each of three classes in a small notes app, fix each and summarise the retest results on one page.
About this course
The main vulnerability classes OWASP highlights and why they happen.
What you will learn
- Getting started
- Injection
- Identity, files and the browser
- Fixing and verifying
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.