Praktischer QA-Kurs

Security Testing: Authorized Web and API Assessment

A practical course from written scope, HTTP and TLS, and threat modeling through controlled testing of authentication, sessions, authorization, injection, browser and server boundaries, APIs, dependencies, and remediation.

16 LernsitzungenVollständiger Kurs · kostenlos

Kursübersicht

Woran Sie arbeiten werden

Lehrplan

Entdecken Sie den vollständigen Lernpfad.

Entdecken Sie hier Lektions- und Thementitel. Registrieren Sie sich und melden Sie sich an, um die Materialien zu lesen und kostenlos an den Wissensüberprüfungen teilzunehmen.

Lektion 11. Authorization, scope, and rules of engagement

Theory, local laboratories, and evidence

ArtikelMaking a security test authorized, controlled, and reproducible
WissenscheckApplied checkpoint

Lektion 22. HTTP, TLS, and trust boundaries

Theory, local laboratories, and evidence

ArtikelHow a request reaches data and where trust changes
WissenscheckApplied checkpoint

Lektion 33. Threat modeling and attack surface

Theory, local laboratories, and evidence

ArtikelFrom a system model to prioritized testable threats
WissenscheckApplied checkpoint

Lektion 44. Burp Suite and OWASP ZAP in a local lab

Theory, local laboratories, and evidence

ArtikelA scoped proxy workflow, passive findings, and manual confirmation
WissenscheckApplied checkpoint

Lektion 55. Authentication and account recovery

Theory, local laboratories, and evidence

ArtikelTesting the identity lifecycle without bulk login attempts
WissenscheckApplied checkpoint

Lektion 66. Sessions, tokens, and CSRF

Theory, local laboratories, and evidence

ArtikelSession lifecycle, cookie boundaries, and protection of state-changing requests
WissenscheckApplied checkpoint

Lektion 77. Authorization and access control

Theory, local laboratories, and evidence

ArtikelObject, function, and property permissions in a two-user matrix
WissenscheckApplied checkpoint

Lektion 88. Injection and the data–interpreter boundary

Theory, local laboratories, and evidence

ArtikelSafe canaries, parameterization, and least privilege
WissenscheckApplied checkpoint

Lektion 99. XSS and browser security boundaries

Theory, local laboratories, and evidence

ArtikelOutput contexts, DOM sinks, sanitization, CSP, and safe evidence
WissenscheckApplied checkpoint

Lektion 1010. Server-side input, URL, file, and parser boundaries

Theory, local laboratories, and evidence

ArtikelSSRF, path traversal, uploads, XXE, and deserialization in a controlled laboratory
WissenscheckApplied checkpoint

Lektion 1111. Comprehensive API security testing

Theory, local laboratories, and evidence

ArtikelInventory, contracts, authorization, resource limits, and business flows
WissenscheckApplied checkpoint

Lektion 1212. Security configuration, TLS, and error handling

Theory, local laboratories, and evidence

ArtikelSecure defaults from edge to application and evidence without secret disclosure
WissenscheckApplied checkpoint

Lektion 1313. Business logic, abuse, and concurrency

Theory, local laboratories, and evidence

ArtikelTesting workflow invariants, replay, idempotency, and race conditions
WissenscheckApplied checkpoint

Lektion 1414. Dependencies, secrets, and the software supply chain

Theory, local laboratories, and evidence

ArtikelFrom source and lockfile to SBOM, provenance, artifact, and deployment
WissenscheckApplied checkpoint

Lektion 1515. Detection, reporting, and remediation

Theory, local laboratories, and evidence

ArtikelTurning evidence into a reproducible risk decision and a closed defect
WissenscheckApplied checkpoint

Lektion 1616. Security assessment capstone

Theory, local laboratories, and evidence

ArtikelA complete authorized local SecurityLab assessment from charter to retest
WissenscheckApplied checkpoint