Pratik QA kursu

Security Testing: Authorized Web and API Assessment

A practical course from written scope, HTTP and TLS, and threat modeling through controlled testing of authentication, sessions, authorization, injection, browser and server boundaries, APIs, dependencies, and remediation.

16 öğrenme oturumlarıTam kurs · ücretsiz

Kursa genel bakış

Ne üzerinde çalışacaksınız

Kurs müfredatı

Öğrenme yolunun tamamını keşfedin.

Ders ve konu başlıklarını burada keşfedin. Materyalleri okumak ve bilgi kontrollerini ücretsiz almak için kaydolun ve oturum açın.

Ders 11. Authorization, scope, and rules of engagement

Theory, local laboratories, and evidence

MakaleMaking a security test authorized, controlled, and reproducible
Bilgi kontrolüApplied checkpoint

Ders 22. HTTP, TLS, and trust boundaries

Theory, local laboratories, and evidence

MakaleHow a request reaches data and where trust changes
Bilgi kontrolüApplied checkpoint

Ders 33. Threat modeling and attack surface

Theory, local laboratories, and evidence

MakaleFrom a system model to prioritized testable threats
Bilgi kontrolüApplied checkpoint

Ders 44. Burp Suite and OWASP ZAP in a local lab

Theory, local laboratories, and evidence

MakaleA scoped proxy workflow, passive findings, and manual confirmation
Bilgi kontrolüApplied checkpoint

Ders 55. Authentication and account recovery

Theory, local laboratories, and evidence

MakaleTesting the identity lifecycle without bulk login attempts
Bilgi kontrolüApplied checkpoint

Ders 66. Sessions, tokens, and CSRF

Theory, local laboratories, and evidence

MakaleSession lifecycle, cookie boundaries, and protection of state-changing requests
Bilgi kontrolüApplied checkpoint

Ders 77. Authorization and access control

Theory, local laboratories, and evidence

MakaleObject, function, and property permissions in a two-user matrix
Bilgi kontrolüApplied checkpoint

Ders 88. Injection and the data–interpreter boundary

Theory, local laboratories, and evidence

MakaleSafe canaries, parameterization, and least privilege
Bilgi kontrolüApplied checkpoint

Ders 99. XSS and browser security boundaries

Theory, local laboratories, and evidence

MakaleOutput contexts, DOM sinks, sanitization, CSP, and safe evidence
Bilgi kontrolüApplied checkpoint

Ders 1010. Server-side input, URL, file, and parser boundaries

Theory, local laboratories, and evidence

MakaleSSRF, path traversal, uploads, XXE, and deserialization in a controlled laboratory
Bilgi kontrolüApplied checkpoint

Ders 1111. Comprehensive API security testing

Theory, local laboratories, and evidence

MakaleInventory, contracts, authorization, resource limits, and business flows
Bilgi kontrolüApplied checkpoint

Ders 1212. Security configuration, TLS, and error handling

Theory, local laboratories, and evidence

MakaleSecure defaults from edge to application and evidence without secret disclosure
Bilgi kontrolüApplied checkpoint

Ders 1313. Business logic, abuse, and concurrency

Theory, local laboratories, and evidence

MakaleTesting workflow invariants, replay, idempotency, and race conditions
Bilgi kontrolüApplied checkpoint

Ders 1414. Dependencies, secrets, and the software supply chain

Theory, local laboratories, and evidence

MakaleFrom source and lockfile to SBOM, provenance, artifact, and deployment
Bilgi kontrolüApplied checkpoint

Ders 1515. Detection, reporting, and remediation

Theory, local laboratories, and evidence

MakaleTurning evidence into a reproducible risk decision and a closed defect
Bilgi kontrolüApplied checkpoint

Ders 1616. Security assessment capstone

Theory, local laboratories, and evidence

MakaleA complete authorized local SecurityLab assessment from charter to retest
Bilgi kontrolüApplied checkpoint