Cybersecurity: Web application security & SQL injection

Celebrate starting the course and reaching the top 20% milestone, and learn to rate the course, adjust playback speed, enable subtitles, and use Q&A and direct messages for support.

Enable virtualization to run virtual machines in VMware by entering the BIOS setup, turning virtualization on under advanced device configuration, saving changes, rebooting, and verifying in task manager.

Install VMware player, download Kali Linux and Metasploitable 2, and set up a VMware-based virtual lab for ethical hacking practice.

Install VMware Workstation Player to set up a virtual lab with Kali Linux, Metasploitable, and Windows 11, choosing the non-commercial version for free use.

Set up a Kali Linux virtual machine in VMware Workstation by extracting the Kali image, configuring 4 GB of memory, and adding NAT, host-only, and bridged adapters.

Set up a Windows 11 virtual machine for cybersecurity labs by extracting, importing into VMware, and configuring memory and bridged networking, with Kali as attacker and Metasploitable for testing.

Set up and test a multi-VM hacking lab with Kali, Metasploitable, and Windows via VMware Workstation, assign and ping IP addresses, and verify inter-VM connectivity.

Understand legal and ethical considerations for using penetration testing tools, recognizing unauthorized access and data theft violate the law and risk severe consequences.

Explore the exciting world of ethical hacking and cyber security, and learn how white hat hackers test defenses, identify vulnerabilities, and protect systems before criminals exploit them.

Understand why cyber security matters to protect online assets in a digital world, from bank accounts to critical infrastructure. Learn how absence of security could lead to hacking and chaos.

Understand the difference between cyber security and ethical hacking, and how red team offensive security and blue team defensive security work to break, expose, patch, and defend against attacks.

Learn five hacking stages—reconnaissance, scanning, gaining access, maintaining access, and clearing tracks. See how ethical hackers think like thieves, gather OSINT, identify vulnerabilities, and defend systems.

Discover the types of hackers, including script kiddies, green hat, white hat, black hat, grey hat, red hat, blue hats, hacktivists, and APTs, and their motives behind attacks.

Understand the CIA triad—confidentiality, integrity, and availability—and how access controls, passwords, biometric verification, ACLs, and digital signatures protect data and ensure on-demand availability.

Explore information security controls across physical, logical, and administrative measures, and learn preventive, detective, corrective, deterrent, compensating, recovery, and directive controls with practical examples.

Understand the dad triad as the opposite of the CIA triad, including disclosure, alteration, and denial, and learn why preserving confidentiality, integrity, and availability matters in cybersecurity.

Apply zero trust by default, provide zero access to any resource until authentication. Verify identities, enforce least privilege, enable multi-factor authentication, and monitor and log all traffic.

Explore non-repudiation and how digital signatures verify document authenticity, proving who sent or performed an action, with examples like CCTV footage and CEO memos for GST or income tax submissions.

Explore the triple A's of cybersecurity—authentication, authorization, and accounting—and learn five authentication factors, access control lists, and auditing to monitor and prove user activities.

Use gap analysis to identify the gap between current security and desired standards, and determine policies and controls to bridge it.

Explore the purpose and key requirements of compliance standards such as HIPAA, ISO, NIST, and PCI DSS, mandatory by laws and industry regulations, to protect sensitive data.

Explore key cybersecurity terminologies including ethical hacking, vulnerabilities, exploits, penetration testing, payloads, zero day vulnerability, social engineering, patches, firewalls, and encryption.

Learn how networking underpins the digital world, connecting devices to share data across the globe, and why a solid networking foundation is essential for ethical hacking.

Explore the objectives and importance of networking, including communication, resource sharing, data transfer, remote access, collaboration, and centralized management, to enable secure, efficient organization-wide connectivity.

Learn how data travels through internet by dividing messages into packets with sender and recipient addresses, routing them across networks, transmitting through media, reassembling at the destination, and acknowledging receipt.

Explore the three main network types—LAN, WAN, and Wi‑Fi—and how Ethernet and fiber optic cables enable fast, wireless connectivity for mobile devices and Nettops.

Learn how IP addresses uniquely identify devices on a network, distinguishing public addresses for global use from private addresses for local networks.

Explore how IP addresses identify devices, route data packets through routers, and provide location information for geo mapping and cyber forensics to trace origins.

Discover how nat enables multiple devices on a private local network to share one public ip, using a router to map private ip addresses and hide internal devices.

Learn how ports function as gateways that manage data flow, exploring physical, network, software, serial and parallel, and virtual ports, plus port number ranges from 0 to 65,535.

Discover how network services like http, https, dns, dhcp, ftp, smtp, imap, ntp, and VoIP enable communication, resource sharing, and secure connections across networks.

Learn how ports and services interconnect, review common port numbers for http, https, ftp, smtp, pop3, imap, ssh, and rdp, and secure them to protect networks.

Explore the four-layer tcp/ip model, from the network interface to the application layer, and learn how routing, addressing, and protocols like http, dns, and smtp enable web communications.

Explore how the domain name system translates easy-to-remember names into IP addresses, functioning like an internet phone book, and understand its role in web navigation.

Learn how online anonymity works for ethical hackers by using VPNs to create encrypted tunnels, hide real locations, bypass geo restrictions, and securely access private networks.

Explore practical use of vpn tools via a chrome extension to hide online identity, verify ip address, and switch locations, then learn how to enable and remove the extension.

Use proxy servers as intermediaries between testers and target websites to browse as if from a different location, hiding your online identity for privacy, security, and performance.

Explore how to use a proxy to hide your IP and bypass geolocation to access blocked websites, demonstrating a simple proxy tool and IP switching.

Explore what web applications are and how attackers can steal data by injecting commands into text boxes to run malicious scripts, with examples like Gmail, Facebook, and online banking.

Learn how unsanitized and invalid inputs enable hackers to run Linux commands and SQL injections, highlighting the importance of input validation and proper sanitization in web apps.

Learn how unvalidated text boxes enable SQL injection and command injection attacks, and identify common targets like login, password, contact us forms, blog comments, and search boxes.

Explore how parameter tampering works by modifying URL query string parameters like product id and price, highlighting how failed validation enables attackers to buy items at lower prices.

Explore practical parameter tampering on a test web app, showing how altering parameters like category can affect prices and expose web security risks for penetration testing.

Learn how command injection lets a vulnerable web app execute system level commands, bypass input sanitization, and enable unauthorized access, data theft, and full server compromise.

Explore command injection on a vulnerable web app using Kali Linux and DVWA, illustrating how input validation and security levels mitigate such attacks.

Explore reflected XSS, where injected scripts into user input are reflected in responses, leading to cookies being stolen, session hijacking, and redirects to malicious sites.

Demonstrates a practical reflected XSS attack in DVWA, using Kali Linux and Metasploitable, and explores low to high security levels, input sanitization, and script injection techniques.

Understand stored cross-site scripting (XSS), where malicious scripts reside in databases, forums, or user profiles and execute on every view, risking data theft and redirects.

Demonstrates a stored xss attack in a DVWA lab by submitting and storing a malicious script in the guestbook, then shows defense by raising security and flushing the database.

Learn to use Burp Suite to intercept and modify web traffic between client and server, test client side filters, and automate SQL injection and XSS testing with the intruder tool.

Configure Burp Suite in Kali Linux, set up the proxy to 127.0.0.1:8080, enable intercept mode, and forward requests in Firefox to analyze and manipulate web traffic for penetration testing.

Learn how to use Burp Suite to perform session hijacking by intercepting and stealing cookies, enabling a tester to impersonate users in a web application.

Explore how databases store, organize, and manage data using SQL, and learn how SQL injections threaten web applications by exploiting user input in text boxes.

Explore how SQL injections compromise vulnerable web applications by injecting malicious queries into unsafely validated input, risking unauthorized access, data manipulation, and the need for proper sanitization and validation.

Explain authentication bypass and how unsanitized input in login forms enables SQL injection to bypass authentication, risking unauthorized access and compromising web application security.

Explore how authentication bypass works by exploiting weak input validation, leveraging or 1=1 in login queries to grant access despite any password.

Explore practical authentication bypass and SQL injection techniques on vulnerable web apps using Kali Linux, DVWA, and Metasploitable, illustrating how improper input handling can expose databases.

Explore how sqlmap automates sql injection testing to identify injectable databases and generate actionable payloads for ethical hacking, building on prior authentication bypass concepts.

Explore ethical sql injection testing with sqlmap on Kali Linux, enumerate databases and tables, and dump user credentials and contact data from the accurate database’s users table.

Validate and sanitize user input to prevent SQL injections, ensuring input matches expected formats. Use parameterized queries to further safeguard against vulnerabilities.

Reach the final milestone and celebrate finishing the course; join the top 5% by earning and downloading your certificate by email or from the portal.