CNIT 129S: Securing Web Applications

Industry advisors have repeatedly asked us to teach this class, because every modern business needs a web presence and there are far too few workers qualified to protect them from hackers. There are many jobs available for students who learn how to protect our healthcare, financial, and other confidential data from criminals, spies, and pranksters.

Techniques used by attackers to breach Web applications, and how to protect them. How to secure authentication, access, databases, and back-end components. How to protect users from each other. How to find common vulnerabilities in compiled code and source code.

Upon successful completion of this course, the student will be able to:

• Explain the current state of Web application security
• Analyze basic application functionality
• Secure data stores and back-end components
• Protect users from other users
• Demonstrate common exploits and patch their root causes
• Implement servers and firewalls effectively

• Ch 1: Web Application (In)security
• Ch 2: Core Defense Mechanisms
• Ch 3: Web Application Technologies 
• Ch 4: Mapping the Application
• Ch 5: Bypassing Client-Side Controls 
• Ch 6: Attacking Authentication 
• Ch 7: Attacking Session Management 
• Ch 8: Attacking Access Controls 
• Ch 9: Attacking Data Stores (Part 1 of 2) 
• Ch 9: Attacking Data Stores (Part 2 of 2) 
• Ch 10: Attacking Back-End Components 
• Ch 11: Attacking Application Logic 
• Ch 12: Attacking Users: Cross-Site Scripting 
• Ch 13: Attacking Users: Other Techniques (Part 1 of 2) 
• Ch 13: Attacking Users: Other Techniques (Part 2 of 2) 
• Ch 14: Automating Customized Attacks
• Ch 15: Exploiting Information Disclosure