Attacks on web applications and associated protection methods

Objectives

The course goal is to study the most common weaknesses and attacks on web applications and to learn best practices for secure web development. We will also investigate how to use some popular tools for automated security testing of web applications. We study basics of important application security standards and verification techniques. The course will contribute to a better understanding of web security risks and how to counter them.

Content

OWASP Methodology and Top 10 project

Common attacks on web applications

• Code injection with SQL and XPath injections as an example
• Cross-Site Scripting
• Misuse of authentication and session management failures
• File inclusion

Tools

Use some vulnerability scanners and penetration testing tools running them on a vulnerable application like DVWA.

On completion of the course the student should have the following learning outcomes defined in terms of

knowledge, skills and general competence

Knowledge

The student knows

• most common threats to web applications and possible consequences
• basic techniques and tools for attacks on web-applications and learn legal or ethical implications of using these tools
• important application security standards and verification techniques

Skills

The student can

• identify potential vulnerabilities to classical web attacks and suggest relevant countermeasures
• use some tools for web application security testing
• use and promote secure development practices

General competence

The student can explain security-related issues to a non-technical audience, suggest security solutions and argue for them