MODULE 6: Application & Web Security

Lesson 1: Secure SDLC (Software Development Life Cycle) & Code Review

1. What is Secure SDLC?

Secure SDLC = integrating security at every stage of software development.

Stages:

1. Requirements — define security needs
2. Design — plan secure architecture
3. Development — write secure code
4. Testing — security testing & code scanning
5. Deployment — secure configurations
6. Maintenance — patch vulnerabilities, monitor

Why Secure SDLC matters:

• Fixing vulnerabilities early is cheaper
• Prevents security flaws in production
• Reduces risk of breaches
• Ensures compliance (ISO 27001, PCI, GDPR)

2. Secure Coding Principles

Developers must:

• Validate all inputs
• Use parameterized queries (stop SQL injection)
• Avoid hardcoding secrets
• Use proper authentication/authorization
• Disable debug mode in production
• Use encryption for sensitive data
• Avoid outdated libraries

3. Code Review

Developers review each other’s code to:

• Find bugs
• Detect vulnerabilities
• Improve code quality

Tools used:

• GitHub Code Review
• GitLab Merge Request
• Bitbucket Pull Request
• SonarQube
• Checkmarx

Lesson 2: OWASP Top 10

OWASP = Open Web Application Security Project
They publish the Top 10 most critical web application vulnerabilities.

Here are the major one’s developers must understand:

1. Broken Access Control

When a user can access data/functions they shouldn’t.

Example:
Changing URL:

/user/5 → /user/6

And you can view someone else’s data.

2. Cryptographic Failures

Weak or missing encryption.

Examples:

• Using HTTP instead of HTTPS
• Storing passwords without hashing
• Using outdated encryption (MD5, SHA1)

3. Injection

Attacker injects malicious input:

• SQL Injection
• Command injection
• LDAP injection

4. Insecure Design

Lack of security thinking during design phase.

Example:
Application allows unlimited login attempts.

5. Security Misconfiguration

Common mistakes:

• Default passwords
• Debug mode enabled
• Directory listing enabled
• Unused services running

6. Vulnerable & Outdated Components

Using old libraries or frameworks with known vulnerabilities.

7. Identification & Authentication Failures

Weak login and session management:

• No MFA
• Session tokens in URL
• Long session duration

8. Software & Data Integrity Failures

Untrusted updates, CI/CD pipelines not secured.

9. Security Logging & Monitoring Failures

Lack of logs leads to:

• Undetected breaches
• No incident tracking

10. Server-Side Request Forgery (SSRF)

Attacker tricks server into making requests internally.

Lesson 3: API Security

APIs (mobile apps, web apps, backend systems) are a major attack target.

1. Why APIs Are Vulnerable

• Exposed publicly
• Easy to test and attack with tools (Postman, Burp Suite)
• Often return too much data
• Weak authentication

2. Common API Weaknesses

1. Broken Object Level Authorization (BOLA)

Accessing other people’s data by modifying IDs:

GET /api/user/10 → change to → 11

2. Excessive Data Exposure

API returns unnecessary sensitive data.

Example:
API returns full user info; frontend hides it with JavaScript.

3. Rate Limiting Issues

No limits → attacker can:

• Bruteforce
• Spam requests
• Slow down the API

4. Weak Authentication

Tokens not validated properly → attackers impersonate users.

5. Injection in API Calls

Attackers inject code in API parameters.

3. API Security Best Practices

• Always use HTTPS
• Validate tokens (JWT, OAuth)
• Use rate limiting
• Validate all input
• Do not expose internal errors
• Monitor API logs
• Restrict sensitive data access
• Use API gateways (Kong, Azure API Management)

Lesson 4: Database Security

Databases store the most sensitive information: customer data, financial data, credentials, logs, etc. Protecting them is critical.

1. Common Database Threats

• SQL Injection
• Weak authentication
• Misconfigured databases
• Exposed ports
• Default credentials
• Unencrypted backups
• Insider access

2. Best Practices

1. Use Strong Authentication

• No default root/admin passwords
• Use MFA for management consoles

2. Encrypt Data

• Encrypt data at rest (disk)
• Encrypt data in transit (SSL/TLS)

3. Least Privilege

Give applications only the access they need.

Example:
An app should only SELECT data, not DROP tables.

4. Network Controls

• Restrict DB access to internal network
• Use firewalls to limit connections
• Do not expose database to the internet

5. Backup Security

• Encrypt backups
• Store backups securely
• Test recovery procedures

6. Monitoring

• Log queries
• Detect unusual activity
• Detect large data downloads

Lesson 5: Common Web Application Vulnerabilities (Deep Explanation)

This lesson focuses on real attacks developers and IT teams encounter daily.

1. SQL Injection (Detailed)

Attacker injects SQL commands into input fields.

Example:

‘ OR ‘1’=’1

If input isn’t validated, attacker can:

• Bypass login
• Dump database
• Modify data
• Delete tables

Defense:

• Parameterized queries (prepared statements)
• Input validation
• Limit database permissions

2. XSS (Cross-Site Scripting)

Attacker injects JavaScript into websites.

Types:

• Stored XSS
• Reflected XSS
• DOM-based XSS

Impact:

• Steal session cookies
• Redirect users
• Inject malicious forms

Defense:

• Escape user input
• Validate input/output
• Use Content Security Policy (CSP)

3. CSRF (Cross-Site Request Forgery)

User performs unwanted actions unknowingly.

Example:
User is logged into their bank → visits malicious page → auto-submits a request to transfer money.

Defense:

• CSRF tokens
• SameSite cookies
• Re-authentication for critical actions

4. Directory Traversal

Attacker accesses files outside allowed directory:

../../../etc/passwd

Defense:

• Validate file paths
• Block special characters
• Restrict file system access

5. File Upload Vulnerabilities

Attackers upload:

• PHP web shells
• Scripts
• Malware

Defense:

• Validate file type
• Rename uploaded files
• Store outside web root
• Limit upload size

6. Broken Authentication

Includes:

• Weak session management
• Predictable session IDs
• No logout or timeout

Defense:

• Use secure session cookies
• Short session lifetimes
• MFA

Module 6 Summary

Students now understand:

• How secure development works (Secure SDLC)
• The OWASP Top 10 vulnerabilities
• How to secure APIs used in mobile & web apps
• Database security best practices
• How common web app attacks work (SQLi, XSS, CSRF, file upload abuse)

This module answers the question:
“How do we protect websites, APIs, apps, and databases from hackers?”