Secure Coding - Secure application development

Identify threats early through the threat modeling process in the design phase. Apply STRIDE categories and data flow diagrams to prioritize mitigations and security controls.

Discover secure coding standards from OWASP, SAMM, SEI, and MITRE CWE's 25 programming bugs. Learn guidelines for web applications and secure coding across Java, C/C++, Android, Perl, .NET, and iOS.

explains the tcp/ip stack and the http protocol, illustrating layered web architectures, security of every component, and the http request/response structure and handshake sequences for secure coding.

Explore the OWASP web security testing guide for ethical hacking on web apps, covering information gathering, authentication, session management, and input validation with tests, tools, and remediation.

Explore tools for vulnerability assessment and penetration testing (VAPT), including web crawlers, proxies, vulnerability scanners, and pentest frameworks like Burp, ZAP, Nessus, OpenVAS, Metasploit, and WebGoat.

Learn to test a web application using Burp proxy on Kali Linux, configure manual proxy, intercept and modify login requests, and perform brute-force attacks with Intruder.

Explore the sql injection vulnerability lab using the vvwa project to see how input-based sql bypasses login, and apply parametric queries; note that Linq to Entities mitigates it.

Explore cross-site scripting vulnerabilities in an ASP.NET lab by injecting scripts and observing execution, then implement mitigation by validating with a regular expression and normalizing input to prevent bypass.

Understand how os command injection occurs when server-side input reaches the operating system via system() or exec(), and prevent it with a white list of possible values and least-privilege practices.

Explore local file inclusion and remote file inclusion vulnerabilities, learn how input path verification against a whitelist mitigates lfi and rfi attacks, and verify successful defense in a lab.

Learn secure file management to prevent unvalidated file uploads, validate incoming files, don’t rely on extension alone, and check the magic number (first 4 bytes) to stop webshell uploads.

Learn to identify unvalidated file upload vulnerabilities and mitigate risk by enforcing allowed file types, validating file headers, preventing webshell uploads, and enforcing size limits.

Explore how buffer overflow vulnerabilities arise from insufficient input validation in C and C++, stack and heap overflows, and how managed languages mitigate them except in unsafe or unmanaged contexts.

Explore XML external entities (XXE) vulnerabilities in a hands-on lab using the VVWA app, demonstrating an external entity attack pattern and how to mitigate by setting DtdProcessing to Prohibit.

Learn insecure deserialization risk from the Owasp top 10, and prevent tampering of serialized xml or json data by using digital signatures, https, trusted libraries, and type checks, with monitoring.

Explore authentication mechanisms for web applications, including basic, digest, windows integrated, and multi-factor options. Implement form-based authentication across ASP.NET, Java Spring, and PHP, and consider OpenID Connect for single sign-on.

Apply OWASP guidelines for authentication and password management by separating authentication logic, hashing passwords with robust algorithms, enforcing strong passwords, securing resets, and enabling multi-factor authentication.

Learn how web applications manage sessions in a stateless HTTP world, using cookies and session IDs or tokens to authenticate users, store state, and revoke access on logout or timeout.

Explore the main cryptographic algorithm types—symmetric and asymmetric—along with encryption guidelines to safeguard confidentiality, GDPR and ISO 27001 compliance, and secure key storage using FIPS 140-2 validated libraries and TPM.

Explore how symmetric cryptography uses the same key to encrypt and decrypt data, with 256-bit keys and AES as a block-based example for data at rest.

Explain how asymmetric cryptography uses public and private keys for secure data transmission, with digital certificates issued by certification authorities to verify keys, and RSA handshakes to exchange AES keys.

Provide links for further information to support secure coding and secure application development for the course.