Free module
Web and application security
Learn web and application security hands on: SQL injection, XSS, broken access control, weak sessions, secrets and hardening.
The lessons
Each lesson is free to read in full. Create a free account to run its commands in a live lab and to sit its quizzes and tasks.
1 · Container lab
SQL injection: text that changes a query
I can fix a query so that typed text cannot change it.
Read the lesson2 · Container lab
Seeing what is not yours (broken access control)
I can say whether a request should have been allowed.
Read the lesson3 · Container lab
Stopping typed text running as code (XSS)
I can stop a page from running text that a visitor typed.
Read the lesson4 · Container lab
What makes a sign-in or session weak
I can say what makes a sign-in or a session weak.
Read the lesson5 · Container lab
Naming the common kinds of web vulnerability
I can match a vulnerable page to the flaw class it shows.
Read the lesson6 · Container lab
Passwords and keys left in the wrong place
I can find a secret in the wrong place and say where it belongs.
Read the lesson7 · Container lab
Locking down a web server (hardening)
I can say what a web server should hide and what it should refuse.
Read the lesson
Worked in a real lab
Every lesson of this module is worked in a lab started for you alone. The labs it uses:
- SQL injection lab: attack a weak shop search, fix the query and prove the fix
- OWASP Juice Shop lab: a vulnerable web shop to attack in your own copy
- DVWA lab: practise SQL injection and XSS on the Damn Vulnerable Web Application
- WebGoat lab: guided web security lessons with WebWolf in your own copy
- Mutillidae lab: practise SQL injection and XSS on a vulnerable PHP web application
- WrongSecrets lab: find hardcoded secrets and learn where secrets belong
- Web server hardening lab: fix a weak nginx configuration and check it with curl
Teaching a class? Set this module for your students with a teacher guide, marked assignments and a lab for every student.