Web Security: Common Vulnerabilities And Their Mitigation

Name: Web Security: Common Vulnerabilities And Their Mitigation
Rating: 4.3 (669 reviews)

A guide to dealing with XSS, session hijacking, XSRF, credential management, SQLi and a whole lot more

Created byLoony Corn

Last updated 10/2021

English

What you'll learn

Understand how common web security attacks work
Know how to write code which mitigates security risks
Implement secure coding practices to reduce vulnerabilities

Course content

14 sections • 57 lectures • 8h 2m total length

You, This Course and Us1:48
Source Code and PDFs0:04

What is XSS?12:59
Start off with a well known security attack - script injection can wreak havoc on your site.
Learn by example - how does a XSS attack work?13:05
A simple but realistic example of how XSS could affect your site
Types of XSS12:59
Persistent, reflected and DOM based XSS. The differences are subtle but important.
XSS mitigation and prevention11:15
How can you protect yourself from script injection? What are the good practices to follow?

Sanitizing input12:09
Sanitizing input - still not done8:10
Some more techniques by which input can be cleaned up
Validating input14:07
Check for patterns in your input. Only allow those patterns which seem legit!
Validating input - some more stuff to say9:16
PHP offers a whole bunch of ways to validate input, some more here.
Client Side Encoding, Blacklisting and Whitelisting inputs7:03
What else can you do to make sure user input is safe to use?

Rules for the browser11:23
Default directives and wildcards8:40
Specify default directives so things are less onerous and learn to use wildcards
Stay away from inline code and the eval() function8:13
Inline code and the eval() functions usually spell trouble for your site
The nonce attribute and the script hash11:27
If you must use inline code, the Content Security Policy header gives you a few outs.

Broken authentication and session management3:05
All about passwords - Strength, Use and Transit5:24
What makes a good password? Set some constraints so your users are forced to choose strong passwords.
All about passwords - Storage13:17
Do not store passwords in plain text. When it comes to security you cannot trust even those who work with you.
Learn by example - login authentication10:29
A little bit about hashing10:34
All about passwords - Recovery14:25

Who Is Bobby Tables?5:17
Learn by example - how does SQLi work?9:26
Anatomy of a SQLi attack - unsanitized input and server errors8:42
Anatomy of a SQLi attack - table names and column names6:19
Anatomy of a SQLi attack - getting valid credentials for the site5:22
Types of SQL injection8:09
SQLi mitigation - parameterized queries and stored procedures7:47
SQLi mitigation - Escaping user input, least privilege, whitelist validation6:33

Requirements

A basic understanding of how the web browser, rendering, headers, cookies and sessions
A basic understanding of Javascript and PHP to follow the examples

Description

Coat your website with armor, protect yourself against the most common threats and vulnerabilities. Understand, with examples, how common security attacks work and how to mitigate them. Learn secure practices to keep your website users safe.

Let's parse that.

How do common security attacks work?: This course walks you through an entire range of web application security attacks, XSS, XSRF, Session Hijacking, Direct Object Reference and a whole lot more.

How do we mitigate them?: Mitigating security risks is a web developer's core job. Learn by example how you can prevent script injection, use secure tokens to mitigate XSRF, manage sessions and cookies, sanitize and validate input, manage credentials safely using hashing and encryption etc.

What secure practices to follow?: See what modern browsers have to offer for protection and risk mitigation, how you can limit the surface area you expose in your site.

What's included in this course:

Security attacks such as Cross Site Scripting, Session Hijacking, Credential Management, Cross Site Request Forgery, SQL Injection, Direct Object Reference, Social Engineering

Risk mitigation using the Content Security Policy Header, user input validation and sanitization, secure token validation, sandboxed iframes, secure sessions and expiry, password recovery

Web security basics: Two factor authentication, Open Web Application Security Project,

Who this course is for:

Yep! Students who have some experience in web programming and understand basic browser concepts
Nope! Students who are beginners and have never done any web programming

Web Security: Common Vulnerabilities And Their Mitigation

What you'll learn

Explore related topics

Course content

You, This Course and Us2 lectures • 2min

What Is Security?2 lectures • 24min

Cross Site Scripting4 lectures • 50min

User Input Sanitization And Validation5 lectures • 51min

The Content Security Policy Header4 lectures • 40min

Credentials Management6 lectures • 57min

Session Management8 lectures • 52min

SQL Injection8 lectures • 58min

Cross Site Request Forgery4 lectures • 32min

Lot's Of Interesting Bits Of Information3 lectures • 28min

Requirements

Description

Who this course is for: