Cours pratique d'assurance qualité

Security Testing: Authorized Web and API Assessment

A practical course from written scope, HTTP and TLS, and threat modeling through controlled testing of authentication, sessions, authorization, injection, browser and server boundaries, APIs, dependencies, and remediation.

Séances d'apprentissage 16Cours complet · gratuit

Aperçu du cours

Sur quoi vous travaillerez

Programme du cours

Explorez le parcours d’apprentissage complet.

Explorez les titres des leçons et des sujets ici. Inscrivez-vous et connectez-vous pour lire les documents et passer les contrôles de connaissances gratuitement.

Leçon 11. Authorization, scope, and rules of engagement

Theory, local laboratories, and evidence

ArticlesMaking a security test authorized, controlled, and reproducible
Contrôle des connaissancesApplied checkpoint

Leçon 22. HTTP, TLS, and trust boundaries

Theory, local laboratories, and evidence

ArticlesHow a request reaches data and where trust changes
Contrôle des connaissancesApplied checkpoint

Leçon 33. Threat modeling and attack surface

Theory, local laboratories, and evidence

ArticlesFrom a system model to prioritized testable threats
Contrôle des connaissancesApplied checkpoint

Leçon 44. Burp Suite and OWASP ZAP in a local lab

Theory, local laboratories, and evidence

ArticlesA scoped proxy workflow, passive findings, and manual confirmation
Contrôle des connaissancesApplied checkpoint

Leçon 55. Authentication and account recovery

Theory, local laboratories, and evidence

ArticlesTesting the identity lifecycle without bulk login attempts
Contrôle des connaissancesApplied checkpoint

Leçon 66. Sessions, tokens, and CSRF

Theory, local laboratories, and evidence

ArticlesSession lifecycle, cookie boundaries, and protection of state-changing requests
Contrôle des connaissancesApplied checkpoint

Leçon 77. Authorization and access control

Theory, local laboratories, and evidence

ArticlesObject, function, and property permissions in a two-user matrix
Contrôle des connaissancesApplied checkpoint

Leçon 88. Injection and the data–interpreter boundary

Theory, local laboratories, and evidence

ArticlesSafe canaries, parameterization, and least privilege
Contrôle des connaissancesApplied checkpoint

Leçon 99. XSS and browser security boundaries

Theory, local laboratories, and evidence

ArticlesOutput contexts, DOM sinks, sanitization, CSP, and safe evidence
Contrôle des connaissancesApplied checkpoint

Leçon 1010. Server-side input, URL, file, and parser boundaries

Theory, local laboratories, and evidence

ArticlesSSRF, path traversal, uploads, XXE, and deserialization in a controlled laboratory
Contrôle des connaissancesApplied checkpoint

Leçon 1111. Comprehensive API security testing

Theory, local laboratories, and evidence

ArticlesInventory, contracts, authorization, resource limits, and business flows
Contrôle des connaissancesApplied checkpoint

Leçon 1212. Security configuration, TLS, and error handling

Theory, local laboratories, and evidence

ArticlesSecure defaults from edge to application and evidence without secret disclosure
Contrôle des connaissancesApplied checkpoint

Leçon 1313. Business logic, abuse, and concurrency

Theory, local laboratories, and evidence

ArticlesTesting workflow invariants, replay, idempotency, and race conditions
Contrôle des connaissancesApplied checkpoint

Leçon 1414. Dependencies, secrets, and the software supply chain

Theory, local laboratories, and evidence

ArticlesFrom source and lockfile to SBOM, provenance, artifact, and deployment
Contrôle des connaissancesApplied checkpoint

Leçon 1515. Detection, reporting, and remediation

Theory, local laboratories, and evidence

ArticlesTurning evidence into a reproducible risk decision and a closed defect
Contrôle des connaissancesApplied checkpoint

Leçon 1616. Security assessment capstone

Theory, local laboratories, and evidence

ArticlesA complete authorized local SecurityLab assessment from charter to retest
Contrôle des connaissancesApplied checkpoint