Security for Web Applications – in English

In this seminar you will learn how to secure your web applications against the most common and dangerous attacks. You will systematically learn about the most critical security vulnerabilities and try them out on a sample application. Step by step you will mitigate these risks and learn how easy it can be to avoid serious mistakes. The concepts you learn are independent of specific technologies and can certainly be applied to your project.

Inhalt

• Introduction to OWASP (OWASP Top 10, Cheat Sheets, Tools)
• SQL Injection
• Authentication
• Securing secure credentials
• Securing cookies
• Multi Factor Authentication
• Transport Layer Security (SSL / TLS)
• Command Injection
• Insecure Deserialization
• XML External Entity Attacks
• Cross Site Scripting
• Session Hijacking / Session Fixation
• Input Validation / Output Escaping (Sanitization)
• Cross Site Request Forgery (CSRF)
• Same Origin Policy
• Security Header (CSP, CORS, ...)
• Clickjacking
• Tools (OWASP ZAP, sqlmap, …)
• Fuzz Testing
• Function Level Access Control
• Insecure Direct Object References
• Security Development Lifecycle (SDLC)

Voraussetzungen

• You are experienced with at least one programming language and know the basics of web development, i.e. terms like: http, HTML, browser, service.
• Helpful but not mandatory are basic knowledge in SQL and JavaScript
• The exercises will take place in Java, but you do not need special Java knowledge