Month 7 – Web Application Security

 

Month 7 – Web Application Security

Note: All practicals in this module should be performed only on intentionally vulnerable training applications or systems you own or have permission to test.

TopicWhat I Will DiscussToolWhat We Use the Tool ForPracticalTheory AssessmentPractical Assessment
Introduction to Web SecurityWhat web application security is, common website threats, secure web architecture.Web BrowserTo access and interact with web applications for learning.Explore a training web application and identify its main features.Define web application security and explain its importance.Navigate a training application and identify its components.
HTTP & HTTPSHTTP vs HTTPS, SSL/TLS, certificates, encryption, secure communication.Web BrowserTo inspect website security and certificates.Compare an HTTP site with an HTTPS site and inspect the certificate.Explain the differences between HTTP and HTTPS.Verify whether a website uses HTTPS and inspect its certificate.
OWASP Top 10The most common web application security risks and how developers can prevent them.OWASP Juice ShopTo learn about common web security issues in a safe environment.Explore OWASP Juice Shop and identify different challenge categories.List and explain the OWASP Top 10.Identify security issues in a training application.
Authentication & AuthorizationUser login, user roles, permissions, session management, access control.OWASP Juice ShopTo understand how secure authentication and authorization work.Create different user accounts and test role-based access in the training application.Explain authentication vs authorization.Demonstrate proper user access control in the lab.
Cookies & SessionsCookies, sessions, session IDs, secure cookie settings, session timeout.Browser Developer ToolsTo inspect browser cookies and session information.View cookies for a training website using Developer Tools.Explain how cookies and sessions work.Identify session cookies and explain their purpose.
SQL Injection (Concepts & Prevention)What SQL Injection is, why it happens, secure coding practices, parameterized queries.DVWA (Lab)To understand how developers prevent SQL injection in a safe training environment.Complete a guided SQL Injection lesson in DVWA and document secure coding practices.Explain what SQL Injection is and how it can be prevented.Identify vulnerable input fields in the training lab and explain mitigation methods.
Cross-Site Scripting (XSS)Stored, reflected, and DOM XSS, input validation, output encoding.OWASP Juice ShopTo learn how XSS occurs and how developers prevent it.Complete an XSS training exercise in Juice Shop.Explain different types of XSS.Demonstrate how proper input validation prevents XSS in the lab.
Burp Suite BasicsProxy, request/response analysis, repeater, target, safe testing workflow.Burp Suite Community EditionTo inspect and analyze web requests during security testing.Capture requests from a training application.Explain the purpose of Burp Suite.Capture and inspect HTTP requests successfully.
Secure Coding PrinciplesInput validation, output encoding, authentication, least privilege, error handling.Visual Studio CodeTo write and review secure code.Review sample code and identify security improvements.Explain secure coding principles.Identify and correct security issues in sample code.
Web Application Security ReviewSecurity checklist, testing process, reporting, remediation recommendations.OWASP Juice Shop, Burp SuiteTo perform structured web security reviews in a lab.Perform a guided security review of a training web application.Explain the steps of a web security review.Produce a professional web security assessment report.

End-of-Month Project

Project Title

Web Application Security Assessment

Objectives

  • Review a training web application.

  • Verify HTTPS configuration.

  • Review authentication and authorization.

  • Identify common security issues.

  • Recommend security improvements.

  • Produce a professional assessment report.

Tools

  • Burp Suite Community Edition

  • OWASP Juice Shop

  • DVWA

  • Visual Studio Code

  • Web Browser

  • Microsoft Word

Real-Life Projects

Project 1

Website Security Review

  • Review your own website or a website you manage.

  • Check:

    • HTTPS enabled

    • Strong passwords

    • Multi-Factor Authentication for administrators

    • Software updates

    • Secure backups

  • Write a security improvement report.

Project 2

Website Security Checklist
Create a checklist for a small business that covers:

  • HTTPS

  • Strong passwords

  • MFA

  • Regular backups

  • Software updates

  • Secure hosting

  • User account management

  • Security monitoring

End-of-Month Assessment

Theory Assessment (30%)

  • 20 Multiple Choice Questions

  • 10 Short Answer Questions

  • OWASP Top 10 case studies

  • Secure coding scenarios

Practical Assessment (40%)

Students must:

  • Verify HTTPS on a training website.

  • Inspect cookies using browser Developer Tools.

  • Capture requests with Burp Suite.

  • Complete guided exercises in OWASP Juice Shop.

  • Complete a guided SQL Injection lesson in DVWA.

  • Write a web application security assessment report.

Project Assessment (20%)

  • Completeness of the website security review

  • Accuracy of findings

  • Quality of recommendations

  • Professional documentation

Class Participation (10%)

  • Attendance

  • Lab participation

  • Homework

  • Group discussions

  • Practical demonstrations

Comments

Post a Comment

Popular posts from this blog

Nobigdeal Academy Cybersecurity Diploma Programme (12 Months)

Image
Cybersecurity Diploma Programme (12 Months) This programme is divided into four professional learning tracks. Each track lasts three months and builds on the knowledge and skills gained in the previous level. Students begin with the fundamentals of cybersecurity and gradually progress to advanced topics such as cloud security, security operations, digital forensics, and automation. Level 1: Cyber Defender (Foundation) Duration: 3 Months The Cyber Defender track is the foundation of the programme. It is designed for beginners who want to understand how computers, networks, and cybersecurity work. Students will learn how to recognize cyber threats, protect devices, and apply basic security measures to personal and business environments. During this level, students will study: Cybersecurity & Computer Fundamentals Networking Fundamentals Cyber Threats & Security Awareness Students will gain practical skills in: Computer security fundamentals Windows and Linux basics Networking ...
Read more

Month 8 – Security Operations Center (SOC) & Incident Response (Blue Team)

  Month 8 – Security Operations Center (SOC) & Incident Response (Blue Team) Note: This month focuses on defending systems , detecting suspicious activity, and responding to cybersecurity incidents. Topic What I Will Discuss Tool What We Use the Tool For Practical Theory Assessment Practical Assessment Introduction to SOC (Security Operations Center) What a SOC is, SOC roles, Tier 1–3 analysts, how a SOC operates. Microsoft Sentinel (Lab) To monitor and investigate security events from different systems. Explore the Microsoft Sentinel dashboard and identify security alerts. Define a SOC and explain its functions. Navigate the SIEM dashboard and identify security alerts. Security Monitoring Continuous monitoring, logs, alerts, detection methods. Splunk To monitor systems and identify suspicious activities. Import sample logs into Splunk and search for events. Explain why continuous monitoring is important. Search and identify suspicious events in logs. Log Analysis Types of log...
Read more

Month 11 – Programming & Automation for Cybersecurity

  Month 11 – Programming & Automation for Cybersecurity Note: This module teaches students how to use programming to automate security tasks, analyze data, and build simple cybersecurity tools. The emphasis is on defensive automation . Topic What I Will Discuss Tool What We Use the Tool For Practical Theory Assessment Practical Assessment Introduction to Programming for Cybersecurity Why cybersecurity professionals learn programming, programming languages, automation, scripting basics. Visual Studio Code To write, edit, and test scripts and programs. Install VS Code and write your first Python program. Explain why programming is important in cybersecurity. Write and run a Python program that prints a message. Python Basics Variables, data types, operators, input/output, comments. Python 3 To create automation scripts and security tools. Write programs using variables, calculations, and user input. Explain Python variables and data types. Develop a simple interactive Python pro...
Read more