Web Application Security

Web application security is not a checklist you run once — it is a way of reading code that most developers never learn. This course teaches the OWASP Top 10 the way it should be taught: by understanding why an attack works before you learn how to stop it. You will practice every exploit against local, intentionally vulnerable applications (DVWA and OWASP Juice Shop, run via Docker on your own machine) — never against real sites. By the end you will be able to spot SQL injection, XSS, CSRF, broken authentication, IDOR, SSRF and security misconfiguration in a code review, explain the fix, and apply it. The course closes with a practical hardening project on a deliberately vulnerable app.

Course content

OWASP fundamentals

🔒 OWASP Top 10 in depth text

🔒 Anatomy of a web attack text

🔒 Setting up a safe practice target text

Injection attacks

🔒 SQL Injection explained text

🔒 Preventing SQL Injection with parameterized queries text

🔒 Command injection and other injection types text

Client-side vulnerabilities

🔒 Cross-Site Scripting (XSS) explained text

🔒 Preventing XSS with output encoding and CSP text

🔒 Cross-Site Request Forgery (CSRF) text

Authentication and session

🔒 Broken authentication patterns text

🔒 Secure session management text

🔒 Insecure Direct Object References (IDOR) text

Configuration and infrastructure

🔒 Security misconfiguration text

🔒 Security headers essentials text

🔒 SSRF and untrusted redirects text

Practice and project

🔒 API security essentials text

🔒 Secure code review checklist text

🔒 Practical project: hardening a vulnerable app text