Module 6: Web Application Risks: Concepts, Evidence and Fixes
Most organisations are reached through their websites and APIs. For each OWASP Top 10 (2021) risk class you learn what the flaw is, how it appears in logs and code, and the fix. Labs review access logs, vulnerable code and security headers, always on fictional data and with the defensive recommendation.
- Level
- Intermediate
- Study time
- 6 hours
- Lessons
- 6
- Practice labs
- 3
- Assessments
- 2
- Format
- Self-paced, online
What you will learn
By the end of this course you will be able to:
- Review a web application and advise developers on fixes.
- Recognise the log indicators of injection, cross-site scripting, path traversal and broken access control.
- Review a code snippet, name the OWASP Top 10 (2021) category and write the correct fix.
- Audit HTTP response headers and cookies and recommend a secure configuration.
Before you start
Module 5: Exploitation Fundamentals: Concepts, Case Studies and Defence
Tools you will use
Course outline
6 lessons in 2 modules.
Sub-module 6.1: How web apps break
- How web apps and APIs work, and the OWASP Top 10 (2021)
- Seeing web traffic: proxies and logs
Sub-module 6.2: Common web risks, evidence and fixes
- Injection and cross-site scripting: flaw, evidence, fix
- Broken access control and the rest of the Top 10
- Security headers and misconfiguration
- Worked example: reviewing an access log
Practice labs and assessments
Labs run in the browser as simulations. They never touch a real system.
3 practice labs
- Reading a web access log Beginner, 30 min
- Reviewing vulnerable code and writing the fix Intermediate, 35 min
- Header audit and web risk triage Advanced, 40 min, final lab
2 assessments
- Module 6 knowledge check
- Module 6 final quiz
The pass mark is 70%. You can retake an assessment.
Take Module 6: Web Application Risks: Concepts, Evidence and Fixes
Request access and your instructor will set up your account.