Explore cross-site request forgery (CSRF), how browsers attach cookies to requests, and how session cookies enable hijacking. Examine an inside home scenario with private IP devices vulnerable to such attacks.

Explains csrf attacks on get requests, using url parameters and image tricks, contrasts get and post methods, and demonstrates defenses in a social network lab.

Examine how a self-propagating XSS worm spreads across social networks by copying its payload into profiles, propagating to others through the DOM and getElementById techniques.

Set up a MySQL database in a container, initialize it with a root password and seed data, and perform create, insert, and select queries with where conditions.

Demonstrates sql injection against a login form's select statement, showing how crafted input, comments, and logical operators can bypass passwords and access accounts.

Learn how prepared statements separate code and data to prevent injection attacks, and how parameter binding with placeholders improves security and performance.

Explore the clickjacking attack, how iframes work, and how the content security policy defends against it, in a hands-on lab setting up three web servers for experiments.

Learn how iframes embed pages from other sites using the source attribute, explore sizing, overlapping, borders, and transparency, and understand how the click juking attack influences their use.

Explore iframe security features that enforce the same-origin policy, control parent-child and sibling access, and leverage sandbox options to isolate content, block scripts, and manage top navigation.