Web applications are the most exposed part of most organisations, and the same handful of mistakes cause most breaches. This module starts with the OWASP Top 10, the industry's list of the most critical web application risks, so you know what to look for and what to call it.
You'll then study the classic flaws in detail: SQL injection and how prepared statements stop it, cross-site scripting (XSS) and why escaping output matters, and broken access control, including IDOR and privilege escalation. The module finishes with the habit that prevents most of them: secure coding, starting with input validation.
Once you can recognise these flaws, you'll be ready for the next module, Identity & Access Management, where you control who gets in and what they can do.
What OWASP is, what the Top 10 list of web application security risks contains, and a short introduction to each category.
What SQL injection is, how an attacker abuses unsanitised input in a database query, and how prepared statements defend against it.
How attackers inject JavaScript through a malicious comment, what a hijacked admin session can lead to, and how to defend by escaping output and never trusting user input.
Vertical and horizontal privilege escalation, insecure direct object references with examples, how testers find them with Burp Suite, and how to mitigate them.
Why validating input protects an application against common vulnerabilities, and how to implement robust validation techniques as a developer.