Close the holes attackers actually reach for — a forged cookie, a leaked table, a comment box that runs code — before a stranger does.
You shipped the login form, the file upload, the admin dashboard — and you have no honest way to tell whether any of it survives someone actively trying to get in. Real breaches are rarely exotic: a session cookie missing one attribute, a database query glued together with string concatenation, a comment field that renders whatever markup a stranger pastes in. This course works the defensive side of each of those, in the order an attacker meets them — threat-modeling a feature before you build it, then authentication and sessions, authorization and object-level ownership checks, SQL injection (SQLi) and its siblings, cross-site scripting (XSS) plus the Content Security Policy (CSP) that contains it, cross-site request forgery (CSRF) and server-side request forgery (SSRF), transport and cookie hardening, the ways good cryptography gets used wrong, supply-chain and prototype-pollution threats, and finally logging, detection, and what you actually do at 2am when an alert fires. Every module is anchored in OWASP, MITRE ATT&CK, and published CVEs, and you close it out by picking one of five capstones and hardening real code you control.
Built by Lakshya Kumar
Paste this into any AI chat. Fill in the bracketed parts with your context — you'll get back a straight answer on whether this belongs on your plate.
We grant free access case-by-case — students, career-switchers, builders on a tight budget. Sign in to send us a note.
Sign in to applyFinished the tasks? Take the prompt to your AI and get tested on it. We copy the prompt and open the app — just paste it in.
One wrong default in password storage or cookie flags can hand over every account at once — this is where you get it right.
Most access bugs are not a missing login but a missing ownership check, and they leak one record at a time until someone notices.
Parameterise and allowlist everywhere and the oldest bug class on the web stops working on your app for good.
Output encoding, a strict Content Security Policy, and Trusted Types stack up so one missed escape is not a stolen session.
Cross-site and server-side forgery both work by making your own trusted code do someone else’s bidding — close both doors.
A handful of response headers and one strict TLS config shut down whole attack classes for the cost of an afternoon.
Nobody breaks the cipher — they break the mode you picked, the token check you skipped, and the key that never rotated.
Your riskiest code may be a dependency you never read or a service worker you shipped once and forgot — audit both.
Prevention eventually fails, so what matters is how fast you notice, what your logs can prove, and who does what at 2am.
Complete all modules, then submit the required number of capstone projects. Each must earn a passing rating from an admin reviewer.
Stand up OWASP Juice Shop locally. Produce a written audit covering all ten 2021 OWASP categories: for each, identify at least one vulnerability in Juice Shop, demonstrate exploitation with screenshots/curl commands, and propose the production fix. Format: one finding per page, severity (CVSS v3.1), reproduction, fix, and a detection rule.
I am learning web application security — threat modeling, authentication and authorization, injection attacks (SQL, NoSQL, command, template), XSS (reflected/stored/DOM), CSRF and SSRF, transport security (TLS, CORS, cookies, security headers), crypto pitfalls (JWT, ECB, padding oracles, timing), modern web threats (prototype pollution, supply chain, CDN cache poisoning), and detection/incident response. Help me work through the actual mechanics with reference to real CVEs, real WAF behaviour, and real OWASP / MITRE ATT&CK / NIST guidance.
Build an auth system with WebAuthn passkeys as the primary factor, TOTP as fallback, argon2id for any password component. Include session rotation on every privilege boundary, secure cookie attributes (HttpOnly + Secure + SameSite + __Host-), credential-stuffing defences (per-IP and per-account rate limits + Pwned Passwords check), and per-device login notifications. Test session revocation completes in <1 second.
Take a real JS application. Implement a nonce-based strict CSP in report-only first; verify zero legitimate-traffic violations; promote to enforced. Enable `require-trusted-types-for 'script'` and route every TypeError through a Trusted Types policy backed by DOMPurify. Submit the before/after CSP, the policy code, and a write-up of what broke during migration and how you fixed it.
Produce a written audit of every cryptographic primitive in a real codebase: hashes (where, what algorithm, what use case), signing (JWT alg, key management), encryption (mode, AEAD?), random (CSPRNG everywhere?), key storage (KMS-managed?). For every finding below 2026 best practice, propose a fix with effort estimate. Implement the top three findings.
Stand up a working web-app security stack: structured logs for every authenticated request (who, action, object, outcome) shipped to a separate sink, five tuned detection rules (credential stuffing, geo-velocity, privilege escalation, mass export, unusual error spike) with their queries written down, one honeytoken alerting end-to-end, and a 1-page IR runbook. Run a tabletop exercise against the stack and document gaps.
Definitive defence-side references for every web vulnerability.