Web Application Security

Untrusted input reaching a dangerous sink without being neutralised for that context. A sink is a SQL query, HTML output, a file path, or a shell command. The fix always matches the sink: parameterise for SQL, encode output for HTML, and allow-list for file paths.

Because an attacker removes the browser from the loop and sends the request directly with a proxy or curl. Length limits, dropdowns, and required fields in the page are user-experience features. Only checks the server enforces on hostile input actually protect anything.

The OWASP Top 10 is the industry reference list of the most critical web application risk categories, such as broken access control and injection. This course attacks and then fixes a representative member of each category on intentionally vulnerable lab targets.

Only against systems you own or are explicitly authorised to test, such as your own lab target or a bug-bounty program whose written scope permits it. Testing anyone else's live site without permission is a crime under computer-misuse laws in most countries.

An intercepting proxy to read and edit requests, and a command-line HTTP client such as curl to send precise requests and read full responses including headers and cookies. Everything in this lesson works against your own lab target.

The database compiles the fixed query text first and attaches user values to placeholders afterwards, so a value is never parsed as SQL syntax. Placeholders only bind values, though: table names, column names and ORDER BY direction cannot be bound and need an allow-list instead.