Web application security

48 courses, 759 lessons. A real Kali Linux lab in the browser.

The web and browser security model: HTTP, origin, cookies, CORS and CSP (Level 101, 20 lessons): You read a web request line by line and see in your own lab app how the browser keeps origins apart and what cookies, CORS and CSP protect.
Web vulnerabilities fundamentals (OWASP) (Level 101, 20 lessons): The main vulnerability classes OWASP highlights and why they happen.
Introduction to Burp Suite (Level 101, 15 lessons): You install Burp Suite Community, intercept browser traffic, replay and decode requests, all against your own lab app.
First steps in web CTFs (Level 101, 15 lessons): While hunting flags in small single-flaw web puzzles you build habits of exploring, changing requests and gathering evidence, and you write a fix proposal for every flag.
Web surface review with ffuf and proxies (Level 201, 21 lessons): Seeing your own application’s external surface and closing leaks and exposures.
Injection flaws (SQL, command) and closing them (Level 201, 18 lessons): Why command and SQL injection happen, their trace in logs and the lasting fix.
Burp Suite in depth: Intruder, session rules and extensions (Level 201, 16 lessons): Using Intruder attack types, session handling rules, macros and extensions, you test access control systematically in a multi-role lab app.
Application scanning and automation with ZAP (Level 201, 16 lessons): With the open-source ZAP you scan your own app manually and automatically, set up authenticated scanning, weed out false positives and move scanning into the CI pipeline.
Authentication security: passwords, MFA and login flows (Level 201, 17 lessons): You apply in code and in Burp how passwords should be stored, the disclosure and brute-force risks in the login flow and the correct set-up of MFA and passkeys.
Session management: from token to logout (Level 201, 15 lessons): You examine every step from creating the session token to logging out, recognising fixation, timeout and revocation mistakes with Burp and fixing them in code.
Access control: IDOR and privilege checks (Level 201, 16 lessons): You learn where authorisation checks get forgotten in code, how to recognise IDOR and privilege escalation with two accounts, and how to close them for good with a central policy layer.
Cross-site scripting (XSS): reflected, stored and DOM (Level 201, 17 lessons): You find where data gets mixed into HTML as code, recognise the three XSS types in the lab app, close them with context-aware encoding and sanitising, and retest.
CSRF, SameSite and clickjacking (Level 201, 15 lessons): You recognise in your own app the request forgery caused by the browser sending cookies by itself and the invisible-frame trick, and close them with tokens, SameSite and framing rules.
File upload and path traversal flaws (Level 201, 15 lessons): You find code that builds file paths from user input or trusts uploaded files, test the weak checks with Burp and close them with safe storage and canonical path checks.
REST API security fundamentals (Level 201, 15 lessons): You read a REST API’s endpoints and OpenAPI definition, recognise core mistakes such as object-level authorisation and excessive data exposure with Burp, fix them in code and watch for them in gateway logs.
Security headers and TLS for web apps (Level 201, 15 lessons): You write the headers that tell the browser its security rules, set up TLS versions, cipher suites and the certificate chain correctly, then measure the result with tools and keep watching it.
Web server hardening with nginx and Apache (Level 201, 17 lessons): You close what the web server in front of the app leaks, fix the typical traps in nginx and Apache configuration, and manage hardening as code verified by tests.
Reporting web security findings (Level 201, 15 lessons): You write up a finding with reproducible steps, evidence and an actionable fix, justify its severity with CVSS, and prepare an executive summary and a retest report.
Server-side flaws: SSRF, XXE, JWT and defence (Level 301, 15 lessons): SSRF, XXE, JWT mistakes and upload security: how they happen and how to close them.
Client-side flaws: XSS, IDOR and authentication defence (Level 301, 17 lessons): XSS, session and access-control mistakes and their fixes.
SQL injection in depth (Level 301, 18 lessons): You find unsafe query patterns across languages and ORMs, confirm blind and second-order injection in your own app, and secure the lasting fix with a coding standard, database settings and CI rules.
Injection beyond SQL: command, template, NoSQL, LDAP and header (Level 301, 18 lessons): You recognise where data turns into code in OS commands, template engines, NoSQL, LDAP and HTTP headers, and apply the safe API, the fix and a detection rule for each.
XSS and CSP in depth (Level 301, 15 lessons): You recognise XSS in hard output contexts, frameworks and rich text, and protect a single-page app with a nonce-based strict CSP, Trusted Types and a well-configured sanitiser.
Server-side request forgery (SSRF) in depth (Level 301, 15 lessons): You see how URL-taking features open the server to the internal network, show in the lab why block-lists are not enough, and build a lasting defence with allow-lists, an egress proxy and metadata protection.
XXE and insecure deserialization: not trusting the parser blindly (Level 301, 17 lessons): You recognise in code and traffic how XML entities and object serialization turn into flaws, configure parsers safely language by language, move to safe data formats and hunt for attack traces in the logs.
OAuth 2.0, OpenID Connect and JWT security (Level 301, 18 lessons): You follow the authorisation code flow, PKCE and the ID token step by step, and find, fix and retest redirect_uri, state and JWT validation mistakes in the lab single sign-on set-up.
Business logic flaws (Level 301, 15 lessons): You find the flaws scanners miss, born from the developer’s assumptions, by mapping the workflow, then close and monitor them with a server-side state machine, abuse-case tests and business metrics.
The OWASP API Security Top 10 classes (Level 301, 15 lessons): You recognise every class in the OWASP API Security Top 10 in the code, traffic and logs of a mobile app back end, fix them and bring version and inventory management into order.
GraphQL security (Level 301, 16 lessons): You examine a GraphQL schema and its resolvers, recognise flaws from missing authorisation, batching and deep queries, and harden the API with query limits and persisted queries.
Client-side security: code that runs in the browser (Level 301, 15 lessons): You recognise risks born in the browser from cross-origin communication, JavaScript-specific flaws and third-party scripts, and close CORS, postMessage, prototype pollution and SRI mistakes in code.
Advanced Burp Suite: automation and extension development (Level 301, 15 lessons): You configure the Burp scanner and Collaborator in your own lab, write Bambdas and BChecks, and build an extension your team can use with the Montoya API.
Detecting web attacks from logs (Level 301, 16 lessons): You make your app log the right security events, read the traces scans, injection and identity attacks leave in logs, write Sigma and SIEM rules, and test detection by replaying the attack in the lab.
Writing and tuning WAF rules: ModSecurity and OWASP CRS (Level 301, 18 lessons): You put a web application firewall in front of your own app, tune the OWASP CRS by weeding out false positives, write virtual patches and rate-limit rules, verify rules with tests and move safely to blocking mode.
Secure code review fundamentals (Level 301, 16 lessons): You review code by following data from source to dangerous sink, go through identity, authorisation, cryptography, error handling and dependencies with checklists, and speed up the review with Semgrep and CodeQL.
Threat modelling for web applications (Level 301, 15 lessons): You draw a web app’s data flow diagram, find threats with STRIDE and attack trees, tie mitigations to verification tests and turn threat modelling into part of the team’s routine.
Bug bounty programmes and responsible disclosure (Level 301, 15 lessons): You learn the rules of bug bounty programmes and disclosure policies, the legal differences between countries and the ethical limits, work methodically on a fictional programme and write a submission, and set up the disclosure process on the organisation’s side.
Practice assessment: Lunarbay Market (e-commerce) (Level 301, 15 lessons): You assess the fictional Lunarbay Market’s lab application under a signed authorisation from plan to report, fix the findings with its developers, write detection rules and retest.
Web CTF arena (Level 301, 15 lessons): You collect flags in intermediate puzzles covering server-side, client-side and identity flaws, chain small flaws together and write a fix note for every solution.
SAML and enterprise single sign-on security (Level 401, 14 lessons): You decode SAML flows and assertions, find and close validation gaps such as signature wrapping, unsigned assertions and replay in the service provider, and set up provisioning and SSO event monitoring.
Race conditions and concurrency flaws (Level 401, 14 lessons): You find flaws born in the gap between check and use in code, prove them in your own lab with concurrent requests, close them with database transactions, atomic operations and idempotency keys, and retest under load.
Protocol-level HTTP flaws: request smuggling and cache poisoning (Level 401, 14 lessons): You safely recognise flaws born when the front end and back end read a request differently, and from cache rules, in your own CDN–proxy–app chain, close them with protocol and cache settings and watch for anomalies in the logs.
Secure code review by language: PHP, Python and JavaScript (Level 401, 16 lessons): You recognise dangerous patterns specific to PHP, Python and Node.js and the traps of popular frameworks, find and fix flaws in each language through pull requests, and write Semgrep rules for these languages.
Secure code review by language: Java, C# and Go (Level 401, 15 lessons): You recognise dangerous patterns specific to Java, C# and Go and configuration mistakes in Spring, ASP.NET Core and Go HTTP layers, fix the flaws in code and write CodeQL queries for these languages.
Practice assessment: Corvane Clinic (patient portal and API) (Level 401, 13 lessons): You assess the fictional Corvane Clinic’s patient portal, OIDC sign-in and REST and GraphQL APIs with a risk-based plan, escalate the critical finding urgently, and report the remediation plan and personal data impact.
Application security at scale: programme, automation and variant analysis (Level 501, 15 lessons): You measure an organisation’s application security programme with OWASP SAMM, spread it through security champions and secure defaults, combine SAST, DAST and SCA in one pipeline, and find a flaw’s whole family with variant analysis.
Practice assessment: Velmora Bank (online banking) (Level 501, 14 lessons): You assess the fictional Velmora Bank’s web banking, signed mobile API and payment flow under the rules of a regulated sector, chain findings to show business impact, close detection gaps with the SOC and report to the board.
Job role capstone: web security tester (Level 501, 14 lessons): As a web security tester you run a complete assessment from the scoping call to the retest, testing against the OWASP WSTG, keeping in daily contact with the client and delivering the technical report and executive summary.
Job role capstone: application security engineer (Level 501, 13 lessons): As a product team’s application security engineer you run design and code reviews, set up the CI pipeline and WAF guardrails, triage an external vulnerability report and manage the emergency fix and post-incident review.

Projects

Review and correct cookie, CORS and CSP settings: You examine the cookie flags, CORS responses and content security policy of Karaçam Mobilya’s lab dealer site. You correct the loose settings and show each setting before and after, with an explanation, in a table.
A request map and first review of a booking site: You browse Mercanköşk Otelcilik’s lab booking site through Burp and map its pages, requests and data entry points. You match the map with the OWASP categories and write a first review note showing where to look first.
Close the SQL injection in a product search: You find the SQL injection weakness in your own product search box, fix the code with safe queries, and show with a test that it is closed.
Threat-model a login service and add a second factor: You list the threats to a small login service, add a second verification step against the biggest one and test that it works.
Close the XSS weakness in a parent portal: On your own copy of Gelincik Okulları’s lab parent portal you test how the announcement and comment fields display entered text. You add output encoding and a content security policy and show with a test that the weakness is closed.
Add CSRF and clickjacking defences to a supplier portal: You check whether the forms that change account settings in Ayçiçeği Gıda’s lab supplier portal are protected against forged requests and framing. You add tokens, SameSite and a framing restriction, and confirm the defences with tests.
Make file upload safe in an application portal: You examine how the document upload and download feature of Saklıvadi Üniversitesi’s lab application portal checks file type, name and path. You add validation, a safe storage location and path checks, and show the fixes with tests.
Harden an e-services server: nginx, headers and TLS: You audit the version disclosure, directory listing, security headers and TLS settings of the nginx serving Selvikent Belediyesi’s lab e-services site. You harden the configuration and hand in the before/after audit output.
Set up an automated ZAP scan and report the findings: You prepare a ZAP script that scans Göktaşı Yazılım’s lab customer panel on every release. You weed out the false alarms and present the real findings in a report with severity and a fix for each.
Investigate a website backup leak: You investigate a backup file accidentally left reachable on a website, work out what information it exposed, and write the steps to close it.
Test a billing API for cross-account access: In your own test environment you check whether one customer of a billing API can reach another customer's records, and report the finding with a fix.
Fix a password reset flow: You find weaknesses in your own application's password reset flow, make the flow safe, and show with tests that the fix works.
Protect an image fetcher from SSRF: You restrict an image-fetching feature so it cannot be tricked into reaching internal systems (SSRF), and show with a test that the fix works.
Restrict an AI assistant’s tool permissions: You reduce the tools and permissions a company AI assistant can use to the minimum it needs, and test that the limits cannot be crossed.
Put a WAF in front of a store site and tune the rules: You put ModSecurity with the OWASP core rule set in front of Turnalı Perakende’s lab store site. You tune the false alarms that block genuine customer requests, write one site-specific rule and show the results in a tuning record.
Find attack traces in web logs and set up alerts: In prepared access logs from Kuzeyyıldızı Kargo’s parcel-tracking site you sort the attack attempts by type and build the timeline. You write detection rules that catch the same patterns and hand in the investigation report.
Review and fix token validation in a customer app: You review JWT validation (signature, expiry, audience) and the OAuth redirect address settings in Yakamoz Telekom’s lab customer app. You add the missing checks in code and settings and show the fix with tests.
Harden GraphQL security on an appointment API: You examine whether schema introspection is open, the query depth limits and the field-level authorisation checks on Lavinya Klinikleri’s lab appointment API. You fix the gaps, confirm each with a test and write the hardening record.
A web application breach simulation: You work through a breach scenario on a web application in your own lab from start to finish, and collect the findings, evidence and defensive fixes in a report.
A secure code review of an order application: You review the Python and PHP code of Ilgıntepe Tekstil’s lab dealer order application from end to end and report the findings with file and line references. You write patches for the top three findings and confirm them with tests.
Fix a concurrency flaw in ticket sales: On your own copy of Lodoskaya Denizcilik’s lab ferry ticket application you demonstrate with a test that the same gift balance can be spent twice by simultaneous requests. You secure the operation with locking and database transactions and show the concurrency test now passes.
An application security programme: a variant analysis rule pack: Starting from a finding already fixed at Yelkovan Bankası, you write static analysis rules that look for variants of the same mistake and run them on three lab repositories. You triage the results, attach the rules to a check that runs on every change and write the programme metrics note.