Web securitySyllabus

Subject code

İF-2205y

Credits

5

Student workload

90

Semester

Spring semester

Academic year

2

Subject type

Mandatory

Form of education

Full-time

Language of instruction

Azerbaijani

In-class hours

a) 30 saat - mühazirə b) 30 saat - laboratoriya

Out-of-class hours

a) 60 saat - TSİ b) 30 saat - MRTSİ

The subject covers the working principles of web applications and web services, browser visualization and server interaction mechanisms. within the scope of the subject, the causes of widespread security vulnerabilities in web applications, detection and exploitation methods are studied. students acquire a theoretical and practical understanding of various web attacks, the methods and tools used in these attacks, as well as the appropriate countermeasures. in the educational process, special attention is paid to the advanced approaches of eliminating web application vulnerabilities and ensuring security. through laboratory work, students gain practical skills in web application security assessment, exploiting vulnerabilities, and applying appropriate defense measures. at the end of the course, students acquire the ability to identify and evaluate security risks in web applications and apply appropriate security measures to eliminate them.

• lecture
• laboratory work
• project-based learning
• problem-based learning
• teamwork
• presentations
• interactive discussion

1. 1

   CLO 1: Must know the working principles of web browsers, design, creation and operation of web applications.

2. 2

   CLO 2: Able to develop secure web pages using modern technologies. must know technologies such as html, css, javascript.

3. 3

   CLO 3: Knows how the HTTP protocol works. knows how SSL certificates work and how they protect web pages.

4. 4

   CLO 4: It is aware of the nature of attacks on websites.

5. 5

   CLO 5: Knows how web services like REST and graphql work.

6. 6

   CLO 6: Owasp is familiar with the top 10 security vulnerabilities, able to identify those lists, and mechanisms to prevent them.

1. 1.
   Web security access and browser architectureLecture

   The subject covers the basic concepts of web security, the purpose of the subject, the structure and the organization of practical tasks. processes and threads within the framework of the browser architecture, the logic of rendering web pages and the basic working mechanisms of the browser are explained. the process of parsing and the formation of the document object model (dom) structure and its role in the processing of web pages are reviewed. within the framework of the topic, an initial idea of ​​the main risks and vulnerabilities affecting the security of web applications is formed. it also provides an overview of the most common security risks in web applications based on the OWASP top 10.

2. 2.
   Web systems data collection and intelligenceLecture

   The topic covers initial data collection and intelligence processes for security assessment of web systems. methods of identifying information about web systems based on open sources using search engines are explained. approaches to obtain additional information about the system by reviewing metafiles and other open data sources are studied. the principles of inventorying existing applications on the web server and determining the potential attack surface of the system are reviewed. methods of defining access points that receive user data and interact with the system in web applications are also studied.

3. 3.
   Http protocol and web communication mechanismsLecture

   The topic covers the role of the HTTP protocol in the organization of information exchange in web systems and the main working principles. basic components of http-based systems and client-server interaction are explained. creation and management of HTTP sessions, as well as functions of HTTP headers in data exchange, are reviewed. various HTTP request methods and their use in interaction with web resources are studied. the server response structure, status codes, headers, and key features of the response content are analyzed.

4. 4.
   Dns architecture and dns-based web security threatsLecture

   The topic covers the architecture of the DNS system, its main components, and the process of converting domain names to IP addresses. the main types of attacks targeting DNS infrastructure and web applications and their security implications are reviewed. the working principle of DNS rebinding attacks and the use of these attacks to bypass browser security mechanisms are explained. the main defense approaches applied to protect browsers from DNS rebinding attacks are studied. the role of the private network access mechanism in limiting unauthorized web access to internal network resources is also analyzed.

5. 5.
   Cookies, sessions and browser data storageLecture

   The topic covers the principles of using cookies to manage user state and sessions in web applications. the life cycle of creating, storing, transferring and deleting cookies is explained, as well as the security mechanisms used to restrict access to cookies. tracking users on the web, the privacy risks it poses, and the role of third-party cookies are reviewed. in addition to cookies, other mechanisms used to store data in browsers and their main features are studied. the impact of these mechanisms on the functionality, security and user privacy of web applications is analyzed.

6. 6.
   Session attacks and CSRF vulnerabilitiesLecture

   The topic covers security risks related to session management in web applications and session-based attacks. it explains how the cross-site request forgery (csrf) attack works and how a user's active session can be used to perform unauthorized operations. the role of the samesite cookie attribute in restricting cross-site requests and mitigating CSRF risk is reviewed. security tokens, request validation, and other defense mechanisms are studied to prevent CSRF attacks. it also analyzes the main security recommendations applied in web applications based on the CSRF prevention cheat sheet.

7. 7.
   Xss attacks and defense mechanisms in web applicationsLecture

   The topic covers the causes of cross-site scripting (xss) vulnerabilities, their main types and their impact on web application security. XSS attacks explain the principles of inserting malicious scripts into web pages and executing them in the user's browser. input validation, output encoding, and other defenses are considered to prevent XSS vulnerabilities. learn basic tips for secure programming based on the XSS prevention cheat sheet. it also analyzes the role of content security policy (csp) in reducing XSS risks by restricting the execution of unauthorized scripts.

8. 8.
   Code, command, and SQL injection attacksLecture

   The topic covers injection vulnerabilities in web applications caused by not securely processing user input data. the causes of code injection attacks and the principles of execution of unauthorized code in the application environment are explained. execution of operating system commands through command injection and its impact on system security are considered. the implementation of SQL injection attacks through the manipulation of database queries and the security risks they can create are studied. defense approaches against injection attacks based on input validation, parameterized queries, and secure programming techniques are also analyzed.

9. 9.
   Server security, SSRF and file upload vulnerabilitiesLecture

   The topic covers the main security vulnerabilities on the server side of web applications and their impact on systems. it explains why server-side vulnerabilities exist and how these vulnerabilities lead to unauthorized access, data leakage, and other security risks. it examines how server-side request forgery (ssrf) attacks work and how a server can be used to send unauthorized requests to internal or external resources. vulnerabilities in file upload functions and risks associated with uploading malicious or unauthorized files to the server are studied. key security measures to mitigate server-side vulnerabilities and file upload risks are also analyzed.

10. 10.
    Https and HTTP public key pinning (hpkp)Lecture

    The topic covers the role of the HTTPS protocol in the encryption and secure transmission of data in web communications. explains the principles of web traffic encryption and the role of digital certificates in protecting encrypted traffic. based on the example of encrypted traffic over google and the diginotar incident, trust issues in the certificate infrastructure and their security implications are reviewed. the concept of public key pinning and the purpose of the HPKP mechanism in reducing the risks associated with fake or invalid certificates are studied. also, the principles of storing public key information in the browser and verifying it in subsequent connections through HPKP are analyzed.

11. 11.
    Identification and authentication mechanismsLecture

    The topic covers the main mechanisms used for identification and authentication of users in web applications. user registration, account creation, and account inventory processes are reviewed, as well as security risks associated with predictable user accounts. the principles of secure transmission of credentials over encrypted communication channels, logging and monitoring of login events are explained. the characteristics of password-free authentication protocols and their role in providing secure access are studied. it also analyzes the working principles of JSON web token (jwt) based authentication and its use in web applications.

12. 12.
    Api security, authentication and intelligenceLecture

    The topic covers the basic authentication methods and security mechanisms used to secure apis. methods for identifying existing API services and their properties through API reconnaissance (api recon) are reviewed. the principles of discovering API endpoints, defining their functions, and interacting through various queries are explained. the causes of authentication, authorization, login verification and other security vulnerabilities in apis are studied. also, secure design and defense approaches to prevent API vulnerabilities are analyzed.

13. 13.
    Security of large language models (llm) and llm-based attacksLecture

    The topic covers the main concepts of large language models (llm), working principles and areas of use in modern web applications. the principles of interaction with external systems and data sources through LLM apis, functions and plugins are explained. the main types of attacks targeting llm-based systems and their impact on data privacy, system behavior, and integrated services are reviewed. methods of identifying and evaluating security risks arising during the use of LLM components are studied. ingress and egress authentication, access control, and other defense approaches to prevent llm-based attacks are also analyzed.

14. 14.
    Owasp penetration testing methodology, standards and toolsLecture

    The topic covers the OWASP penetration testing methodology and basic penetration testing standards used in security assessment of web applications. the main stages of penetration testing are explained, such as planning, collecting data, identifying vulnerabilities, exploiting and reporting results. the role of various methodologies and standards in the systematic and consistent implementation of the leak testing process is reviewed. basic penetration testing tools used in security assessment of web applications and related systems and their functions are studied. also, the methodology, stages and principles of selection of tools according to specific security assessment objectives are analyzed.

1. Hoffman a., web application security: exploitation and countermeasures for modern web applications. n.p., o'reilly media,
2. Elie saad, rick mitchell. OWASP web security testing guide, version 4.2. 2020.
3. Web security academy learning paths(opens in a new tab)
4. Owasp web security testing guide(opens in a new tab)
5. Pinto, marcus, and stuttard, dafydd. the web application hacker's handbook: finding and exploiting security flaws. united kingdom, wiley, 2011.