Web application security

Category · Security

OWASP Top 10 with real examples

Injection, XSS, CSRF, broken access control, passwords and secrets, SSRF, security headers. How web applications get attacked and how to close the holes.

5 lessons68 min

To the first lesson

Topics, each as its own lesson

01OWASP Top 10, the attacker mindset and access controlDemo

Where the OWASP list comes from, how to model threats and why IDOR is still number one.

13 min02Injection: SQL, OS commands and ORM pitfalls

Data must never become code. Parameterized queries, execFile instead of exec, and dangerous ORM methods.

13 min03XSS and CSRF: output encoding, CSP, SameSite

Three kinds of XSS, why React does not fully save you, Content Security Policy and protecting forms from CSRF.

14 min04Authentication, secrets and monitoring

Argon2id and bcrypt, login limits, MFA, secrets out of git, key rotation and logs that notice an attack.

14 min05SSRF, file uploads, headers and dependencies

A server that fetches someone else's URL, files that turn into scripts, HSTS, CORS and the supply chain.

14 min

0/5 topics open. This is the course intro, not the whole course on one page.