Corso pratico di QA

Security Testing: Authorized Web and API Assessment

A practical course from written scope, HTTP and TLS, and threat modeling through controlled testing of authentication, sessions, authorization, injection, browser and server boundaries, APIs, dependencies, and remediation.

16 sessioni di apprendimentoCorso completo · gratuito

Panoramica del corso

Su cosa lavorerai

Programma del corso

Esplora il percorso di apprendimento completo.

Esplora i titoli delle lezioni e degli argomenti qui. Registrati e accedi per leggere i materiali e sostenere gratuitamente le verifiche conoscitive.

Lezione 11. Authorization, scope, and rules of engagement

Theory, local laboratories, and evidence

ArticoloMaking a security test authorized, controlled, and reproducible
Verifica della conoscenzaApplied checkpoint

Lezione 22. HTTP, TLS, and trust boundaries

Theory, local laboratories, and evidence

ArticoloHow a request reaches data and where trust changes
Verifica della conoscenzaApplied checkpoint

Lezione 33. Threat modeling and attack surface

Theory, local laboratories, and evidence

ArticoloFrom a system model to prioritized testable threats
Verifica della conoscenzaApplied checkpoint

Lezione 44. Burp Suite and OWASP ZAP in a local lab

Theory, local laboratories, and evidence

ArticoloA scoped proxy workflow, passive findings, and manual confirmation
Verifica della conoscenzaApplied checkpoint

Lezione 55. Authentication and account recovery

Theory, local laboratories, and evidence

ArticoloTesting the identity lifecycle without bulk login attempts
Verifica della conoscenzaApplied checkpoint

Lezione 66. Sessions, tokens, and CSRF

Theory, local laboratories, and evidence

ArticoloSession lifecycle, cookie boundaries, and protection of state-changing requests
Verifica della conoscenzaApplied checkpoint

Lezione 77. Authorization and access control

Theory, local laboratories, and evidence

ArticoloObject, function, and property permissions in a two-user matrix
Verifica della conoscenzaApplied checkpoint

Lezione 88. Injection and the data–interpreter boundary

Theory, local laboratories, and evidence

ArticoloSafe canaries, parameterization, and least privilege
Verifica della conoscenzaApplied checkpoint

Lezione 99. XSS and browser security boundaries

Theory, local laboratories, and evidence

ArticoloOutput contexts, DOM sinks, sanitization, CSP, and safe evidence
Verifica della conoscenzaApplied checkpoint

Lezione 1010. Server-side input, URL, file, and parser boundaries

Theory, local laboratories, and evidence

ArticoloSSRF, path traversal, uploads, XXE, and deserialization in a controlled laboratory
Verifica della conoscenzaApplied checkpoint

Lezione 1111. Comprehensive API security testing

Theory, local laboratories, and evidence

ArticoloInventory, contracts, authorization, resource limits, and business flows
Verifica della conoscenzaApplied checkpoint

Lezione 1212. Security configuration, TLS, and error handling

Theory, local laboratories, and evidence

ArticoloSecure defaults from edge to application and evidence without secret disclosure
Verifica della conoscenzaApplied checkpoint

Lezione 1313. Business logic, abuse, and concurrency

Theory, local laboratories, and evidence

ArticoloTesting workflow invariants, replay, idempotency, and race conditions
Verifica della conoscenzaApplied checkpoint

Lezione 1414. Dependencies, secrets, and the software supply chain

Theory, local laboratories, and evidence

ArticoloFrom source and lockfile to SBOM, provenance, artifact, and deployment
Verifica della conoscenzaApplied checkpoint

Lezione 1515. Detection, reporting, and remediation

Theory, local laboratories, and evidence

ArticoloTurning evidence into a reproducible risk decision and a closed defect
Verifica della conoscenzaApplied checkpoint

Lezione 1616. Security assessment capstone

Theory, local laboratories, and evidence

ArticoloA complete authorized local SecurityLab assessment from charter to retest
Verifica della conoscenzaApplied checkpoint