Skip to main content

Web Application Security

Code: TBD · Credits: 4 · Hours: 60 · Type: ELECTIVE

Web applications are the most common entry point in modern breaches. This elective drills into how they fail, how to attack them safely (with permission), and — most usefully — how to make them durably hard to exploit. Hands-on labs run against intentionally-vulnerable apps.

Key topics​

  • HTTP, sessions, cookies, same-origin policy, CORS, CSP.
  • OWASP Top 10 (current edition): broken access control, injection, SSRF, deserialisation, SSRF, XXE.
  • Authentication patterns: OAuth 2.1, OIDC, WebAuthn / passkeys.
  • API security: REST, GraphQL, gRPC; rate-limiting and quota design.
  • WAF strategy, virtual patching, bot defence.
  • Modern fronts: prototype pollution, dependency confusion, SSRF in cloud metadata.
  • Source-code review for web codebases, threat-modelling specific endpoints.

Learning outcomes​

By the end of this subject, a student should be able to:

  • Perform a structured web-app pentest from recon to report.
  • Implement OAuth/OIDC + passkeys correctly on a sample app.
  • Tune a WAF without breaking legitimate users.
  • Write secure-by-default helper libraries for an internal framework.

Further reading​

  • OWASP ASVS, WSTG, Cheat Sheet Series.
  • Stuttard & Pinto, The Web Application Hacker's Handbook.
  • PortSwigger Web Security Academy.
  • Real-World Bug Hunting — Peter Yaworski.
Chapter notes

Detailed chapter-by-chapter notes for this subject are still being written. The topic outline above mirrors the published syllabus. If you'd like to help draft a chapter, see the contributing guide.

· min read