Course
Web Application Security in Practice
The OWASP landscape from the defender's bench: XSS, CSRF, SSRF, injection, broken auth, and deserialization — exploit, fix, and the headers that hold.
Where Web Apps Break
The trust-boundary model of web attacks, then the two workhorses: cross-site scripting and injection.
- 01The Hostile Client: Trust Boundaries in Web AppsHidden fields, cookies, and request bodies are all forgeable. Replay a request with curl and learn what that means in code.20mOpen
- 02XSS in the Wild: Stored, Reflected, and DOM-BasedWhy 'strip script tags' fails, how context decides the payload, and the encoding-and-CSP stack that actually stops XSS.25mOpen
- 03Injection: SQL, Command Shells, and Template EnginesFrom ' OR '1'='1 to blind timing attacks, shell injection via filenames, and SSTI in Jinja — plus the parameterized fix that holds.30mMembers
Identity, Sessions, and Forged Requests
Broken auth and session handling, CSRF's real gaps, and SSRF — abusing trust between users, browsers, and servers.
- 01Broken Auth and Session HandlingSession fixation, cookies without flags, logout that doesn't log out, reset tokens, and the JWT trade-offs everyone gets wrong.30mMembers
- 02CSRF: Forging Requests the User Never MeantAmbient cookie authority, the SameSite gaps that remain, synchronizer tokens, and why CORS is not a CSRF defense.25mMembers
- 03SSRF: When Your Server Attacks ItselfURL-fetch features turned against cloud metadata and internal networks — plus the resolve-and-pin defense that holds.30mMembers
Serialization, Headers, and Shipping Safely
Insecure deserialization, the header and CSP set that actually holds, and a pre-ship threat-modeling habit.
- 01Insecure Deserialization and the Supply ChainWhy pickle.loads on user bytes is RCE, the yaml.load trap, signing blobs correctly, and the adjacent dependency-trust problem.30mPremium
- 02Headers and CSP That Actually Hold UpThe header set that contains blast radius — nonce-based CSP, HSTS, nosniff, frame-ancestors — and the rollout order that doesn't break prod.35mPremium
- 03Threat-Modeling a Feature Before It ShipsA twenty-minute, sketch-and-STRIDE process applied to a real feature — and how to turn findings into tests that can't regress.40mPremium