Web Application Security

About this course

Every web attack is a crafted HTTP request, and this course teaches you to send the right ones against a deliberately vulnerable app you run locally. Covering the OWASP Top 10, you work through SQL injection, the three kinds of cross-site scripting, cross-site request forgery, and server-side request forgery aimed at internal and cloud-metadata endpoints. You test authentication and sessions for weak hashing, missing rate limiting and poor token handling, exploit unrestricted file uploads, and study session hijacking and fixation along with the cookie flags that stop them. Each topic pairs the attack with its real fix: parameterized queries, output encoding, allow-listed uploads, and secure session design. You practise only on your own target, and the exam has you find and report several of these bugs.