Skip to main content

Learning path

Web Application Security learning path: everything to study, topic by topic

Hands-on web application security assessment covering the OWASP Top 10, injection and XSS, authentication and access control, data protection, advanced server-side attacks, and API security.

Short answer

To learn Web Application Security, work through 6 modules and 24 topics in the order they build on each other. It starts with Web Security Foundations, then moves on to Injection & XSS and Authentication & Access Control. Use the map as a checklist, or measure your level and study only what is missing.

6
modules
24
topics
55
min to assess

What you will study

Topics are grouped by module. Open one to see its objectives and key concepts.

1 · Web Security Foundations4 topics
  • OWASP Top 10

    The OWASP Top 10 categories of web application risk, what each represents, and how the list is used to prioritize testing

    Objectives

    • Identify the OWASP Top 10 categories and what each represents
    • Map a reported vulnerability to its OWASP Top 10 category

    Key concepts

    • A01 broken access control
    • A03 injection
    • A02 cryptographic failures
    • risk ranking
    • awareness
  • HTTP Security Model

    How HTTP works, the role of headers and cookies, the same-origin policy, and the browser security model underpinning web apps

    Objectives

    • Explain how the same-origin policy constrains browser behavior
    • Read an HTTP request/response and spot insecure attributes

    Key concepts

    • request/response
    • headers
    • cookies
    • same-origin policy
    • TLS basics
    • status codes
  • Security Testing Methodology

    A repeatable methodology for testing web apps: reconnaissance, mapping the application, fuzzing inputs, and using an intercepting proxy

    Objectives

    • Map an application's attack surface during reconnaissance
    • Use an intercepting proxy to inspect and replay requests

    Key concepts

    • recon
    • mapping the application
    • fuzzing
    • intercepting proxy
    • attack surface
    • scope
  • Threat Modeling Basics

    Basic threat modeling for web apps: identifying assets, trust boundaries, data flows, and applying STRIDE to enumerate threats

    Objectives

    • Draw trust boundaries and data flows for a simple web app
    • Apply STRIDE to enumerate threats against a component

    Key concepts

    • trust boundaries
    • data flow diagram
    • STRIDE
    • attacker goals
    • assets
2 · Injection & XSS5 topics
  • Input Validation & Output Encoding

    Validating untrusted input with allowlists and applying context-aware output encoding as the primary defense against injection flaws

    Objectives

    • Distinguish input validation from output encoding and when each applies
    • Choose context-appropriate output encoding to neutralize untrusted data

    Key concepts

    • allowlist validation
    • canonicalization
    • context-aware encoding
    • sanitization
    • untrusted input
  • SQL Injection

    Detecting and exploiting SQL injection (union, error-based, blind) and the parameterized-query and least-privilege defenses that eliminate it

    Objectives

    • Exploit and then remediate a SQL injection with parameterized queries
    • Detect blind SQL injection using boolean and time-based techniques

    Key concepts

    • union-based
    • blind/boolean
    • error-based
    • parameterized queries
    • ORM safety
    • second-order
  • Command & LDAP Injection

    Injection beyond SQL: OS command injection via shell metacharacters and LDAP filter injection, plus safe-API remediation

    Objectives

    • Identify OS command injection sinks and replace them with safe APIs
    • Explain how LDAP filter injection bypasses authentication

    Key concepts

    • OS command injection
    • shell metacharacters
    • LDAP filter injection
    • argument injection
    • safe APIs
  • Cross-Site Scripting (XSS)

    Reflected, stored, and DOM-based cross-site scripting: how each is delivered and exploited, and how encoding and safe DOM APIs prevent them

    Objectives

    • Differentiate reflected, stored, and DOM-based XSS and their delivery
    • Remediate XSS with context-aware encoding and trusted sinks

    Key concepts

    • reflected XSS
    • stored XSS
    • DOM-based XSS
    • sinks and sources
    • HTML/JS/attribute context
    • session theft
  • Content Security Policy

    Designing an effective Content Security Policy with nonces, hashes, and strict-dynamic as a defense-in-depth layer against XSS

    Objectives

    • Design a strict CSP that meaningfully mitigates XSS
    • Diagnose why a CSP is bypassable and harden it

    Key concepts

    • script-src
    • nonces and hashes
    • strict-dynamic
    • report-uri
    • defense in depth
    • bypass patterns
3 · Authentication & Access Control4 topics
  • Session Management

    Secure session management: token generation, cookie flags (HttpOnly/Secure/SameSite), fixation prevention, rotation, and timeouts

    Objectives

    • Configure secure session cookies and rotation to prevent fixation
    • Identify weaknesses in session lifecycle handling

    Key concepts

    • session tokens
    • cookie flags
    • session fixation
    • rotation on auth
    • idle/absolute timeout
    • logout
  • Authentication & JWT Pitfalls

    Authentication weaknesses and JWT pitfalls: credential attacks, MFA, secure password storage, and alg-confusion / signature-validation flaws

    Objectives

    • Spot common authentication weaknesses such as missing rate limiting and weak hashing
    • Avoid JWT pitfalls including alg-confusion and unverified signatures

    Key concepts

    • credential stuffing
    • MFA
    • password storage
    • JWT alg confusion
    • none algorithm
    • token expiry
  • Cross-Site Request Forgery

    Cross-site request forgery: how attackers abuse ambient authentication and the synchronizer-token, double-submit, and SameSite defenses

    Objectives

    • Explain how CSRF abuses ambient session credentials
    • Defend state-changing endpoints with tokens and SameSite cookies

    Key concepts

    • CSRF tokens
    • SameSite cookies
    • double-submit
    • state-changing requests
    • origin/referer checks
  • Access Control & IDOR

    Broken access control: insecure direct object references, vertical and horizontal privilege escalation, and server-side deny-by-default enforcement

    Objectives

    • Find broken object-level authorization (IDOR) in an API
    • Design deny-by-default access control enforced server-side

    Key concepts

    • IDOR
    • vertical privilege escalation
    • horizontal escalation
    • forced browsing
    • deny by default
    • object ownership
4 · Data Protection & Configuration4 topics
  • Security Misconfiguration

    Security misconfiguration: default credentials, verbose errors, unnecessary features, and exposed admin interfaces, plus hardening baselines

    Objectives

    • Identify common misconfigurations such as default accounts and verbose errors
    • Apply a hardening baseline to reduce attack surface

    Key concepts

    • default credentials
    • verbose errors
    • open cloud buckets
    • unnecessary features
    • hardening baselines
  • Secure HTTP Headers

    Security-relevant HTTP response headers (HSTS, frame options, content-type options, CORS) and their role in hardening browser behavior

    Objectives

    • Configure security headers to mitigate clickjacking and MIME sniffing
    • Explain the security impact of a permissive CORS policy

    Key concepts

    • HSTS
    • X-Content-Type-Options
    • X-Frame-Options
    • Referrer-Policy
    • CORS
    • cache-control
  • Sensitive Data Exposure & TLS

    Protecting sensitive data in transit and at rest: TLS configuration, cipher selection, data minimization, and avoiding weak cryptography

    Objectives

    • Evaluate a TLS configuration for weak ciphers and protocol versions
    • Reduce sensitive data exposure through encryption and minimization

    Key concepts

    • data in transit
    • data at rest
    • TLS configuration
    • cipher suites
    • PII minimization
    • weak crypto
  • Secrets Management

    Managing application secrets: vaulted storage, rotation, avoiding hardcoded credentials, and responding to leaked keys

    Objectives

    • Design secret storage and rotation that avoids hardcoded credentials
    • Detect and respond to leaked secrets in source control

    Key concepts

    • secrets vault
    • key rotation
    • no hardcoded secrets
    • env var risks
    • leaked credentials
    • least privilege
5 · Advanced Server-Side Attacks4 topics
  • Server-Side Request Forgery

    Server-side request forgery: coercing a server to make attacker-controlled requests to internal services, and allowlist/egress defenses

    Objectives

    • Exploit SSRF to reach internal/metadata services and then remediate it
    • Design URL allowlisting and egress controls against SSRF

    Key concepts

    • internal metadata endpoints
    • URL allowlist
    • DNS rebinding
    • blind SSRF
    • cloud IMDS
    • egress filtering
  • Insecure Deserialization

    Insecure deserialization: how untrusted serialized data and gadget chains lead to RCE, and the safe-format and allowlist defenses

    Objectives

    • Explain how insecure deserialization leads to remote code execution
    • Replace unsafe deserialization with safe formats and type allowlists

    Key concepts

    • object injection
    • gadget chains
    • untrusted data
    • type allowlists
    • safe formats
    • RCE risk
  • File Upload Security

    Securing file uploads: validating type and content, sanitizing filenames, and storing files where they cannot be executed

    Objectives

    • Prevent malicious file uploads through type and content validation
    • Store uploads safely to prevent execution and traversal

    Key concepts

    • content-type validation
    • magic bytes
    • filename sanitization
    • storage outside webroot
    • executable upload
  • Path Traversal

    Path traversal: escaping intended directories via ../ sequences to read arbitrary files, and canonicalization-based remediation

    Objectives

    • Detect and exploit a path traversal flaw, then remediate via canonicalization
    • Constrain file access to an allowlisted base directory

    Key concepts

    • directory traversal
    • dot-dot-slash
    • canonicalization
    • allowlisted paths
    • LFI
    • absolute path checks
6 · API & Application Security3 topics
  • API Security & BOLA

    API security including broken object-level authorization (BOLA), function-level auth, and excessive data exposure across REST/GraphQL APIs

    Objectives

    • Design object-level authorization that prevents BOLA across an API
    • Reason about the OWASP API Security Top 10 in an architecture

    Key concepts

    • BOLA
    • broken function-level auth
    • excessive data exposure
    • API enumeration
    • object ownership
    • OWASP API Top 10
  • Mass Assignment & Rate Limiting

    Mass assignment via unguarded property binding and rate-limiting/quota strategies to prevent abuse and resource-exhaustion attacks

    Objectives

    • Prevent mass assignment with explicit property allowlists
    • Design rate limiting and quotas to resist abuse and exhaustion

    Key concepts

    • mass assignment
    • property binding allowlist
    • rate limiting
    • resource exhaustion
    • abuse prevention
    • quotas
  • Application Threat Modeling at Scale

    Threat modeling for complex web platforms: managing attack surface across services, designing trust boundaries, and prioritizing risk

    Objectives

    • Lead a threat-modeling exercise for a multi-service web platform
    • Prioritize remediation across a large attack surface by risk

    Key concepts

    • attack surface management
    • trust boundary design
    • security architecture review
    • defense in depth
    • risk prioritization

Levels: Junior, Mid, Senior, and Expert

Explain it in your own words

Graded by AI · no account · 1 question

No options to guess from: you write, the AI grades against the topic's rubric and tells you what level your answer reads at.

0 / 600

Already studying Web Application Security?

The assessment measures topic by topic, and your plan skips what you already know.

Measure my level

Open to read. An account is only needed to be measured.

Frequently asked questions

Where should I start studying Web Application Security?

Start with Web Security Foundations: OWASP Top 10, HTTP Security Model, and Security Testing Methodology. The map orders topics by what they depend on, so each one prepares the next.

How long does a full Web Application Security assessment take?

A full assessment of this path takes about 55 minutes. Study time depends on where you start; a diagnostic shows which topics you can skip.

Do I need an account to use this page?

No. The map, objectives and key concepts are open. You only need an account to be measured, get your gap by topic and receive a plan.