Free readiness test
Home / Courses / Application Security

Application Security free online course

OWASP Top 10, secure SDLC, code review, SAST/DAST/SCA and software supply chain.

IntermediateFreeOnline · self-paced
🧩
Build · IntermediateApplication Security
4lessons
1hands-on lab
5questions
13flashcards
  1. Learn
  2. Lab
  3. Assess
  4. Certificate
🏅
Maps to CSSLP, GWEB, OSWEFree to start · certificate on completion

What you'll learn

Lessons

1OWASP Top 10 at a glance

  • Broken Access Control (most common).
  • Cryptographic Failures.
  • Injection (SQL, OS command, LDAP).
  • Insecure Design.
  • Security Misconfiguration.
  • Vulnerable & Outdated Components.
  • Identification & Authentication Failures.
  • Software & Data Integrity Failures.
  • Logging & Monitoring Failures.
  • SSRF.

2Fixing injection the right way

Use parameterized queries, never string concatenation.

// vulnerable
db.query("SELECT * FROM users WHERE id=" + req.query.id)
// safe
db.query("SELECT * FROM users WHERE id = ?", [req.query.id])

Add allow-list validation and least-privilege DB accounts as further layers.

3Secure SDLC

Threat model in design (STRIDE), SAST in pull requests, SCA for dependencies, secrets scanning, DAST against staging, and a security sign-off before release. Track findings like bugs with SLAs.

4Supply chain

Pin dependencies, verify signatures (Sigstore), generate SBOMs (CycloneDX/SPDX), and watch for typosquatted packages and malicious repos. Embedded libraries such as FFmpeg inside containers and wheels need patching too, not just system packages.

Hands-on lab: Practice on OWASP Juice Shop (local)

  1. Run docker run -p 3000:3000 bkimminich/juice-shop on your own machine.
  2. Open http://localhost:3000 and find the Score Board.
  3. Complete 3 one-star challenges and note the OWASP category of each.
  4. For each, write the code-level fix a developer should make.
  5. Run npm audit on a project of yours and triage the top finding.

Outcome: Hands-on recognition of OWASP categories and their fixes, in an intentionally vulnerable app built for training.

Practice questions

Primary defense against SQL injection?

Answer: Parameterized queries. Parameters separate code from data.

Which OWASP category is most prevalent in the 2021 list?

Answer: Broken Access Control. Broken Access Control ranked #1.

SCA tools analyze…

Answer: Third-party dependencies. Software Composition Analysis checks components.

The full graded assessment (5 questions, pass mark 70%) is in the platform.

Key terms

SQL injection
Untrusted input changing the structure of a database query. Fix with parameterized queries.
XSS
Cross-site scripting: injecting script into pages viewed by others. Fix with output encoding and CSP.
CSRF
Tricking a logged-in browser into sending unwanted requests. Fix with anti-CSRF tokens and SameSite cookies.
SSRF
Making a server send requests to unintended destinations, often internal services.
IDOR
Insecure Direct Object Reference: accessing others' data by changing an identifier.
CSP
Content Security Policy header restricting where scripts and resources load from.
SAST
Static Application Security Testing: analyzes source code without running it.
DAST
Dynamic testing of a running application from the outside.
SCA
Software Composition Analysis: finds vulnerable third-party components.
SBOM
Software Bill of Materials listing every component in a product.

See the full cyber security glossary →

Official references

Related courses

♾️FREE

DevSecOps & Secure CI/CD

Building security into pipelines: secrets, scanning gates, IaC security, signed artifacts and SLSA.

Intermediate4 lessons · lab · 5 Qs
📱FREE

Mobile & Endpoint Device Security

iOS and Android security models, MDM, app security (OWASP MASVS) and mobile threats.

Intermediate4 lessons · lab · 4 Qs