Module 10 of 20 — Offensive Security

Web Application Security Deep Dive

Web applications are the primary attack surface for most organizations. Modern web apps are complex ecosystems of frontend frameworks, APIs, microservices, and third-party integrations— each introducing potential vulnerabilities. This module covers defense strategies across all layers.

Web Application Security Layers

Web security must be applied at every layer—a weakness at any level can compromise the entire application.

Network Layer

Focus: Infrastructure security, DDoS protection, TLS configuration.
Threats: Man-in-the-middle, SSL stripping, port scanning.
Tools: Nmap, sslscan, testssl.sh, Cloudflare

Server Layer

Focus: OS hardening, web server configuration, access controls.
Threats: Directory traversal, file inclusion, server misconfig.
Tools: Nikto, Nessus, OpenVAS

Application Layer

Focus: Input validation, business logic, session management.
Threats: SQL injection, XSS, CSRF, broken access control.
Tools: Burp Suite, OWASP ZAP, SQLMap, Browser Dev Tools

Data Layer

Focus: Encryption at rest/in transit, data classification.
Threats: Data leakage, weak crypto, exposed PII.
Tools: Hashcat, John, custom scripts

Essential Security Headers

HTTP security headers provide browser-enforced protections against common web vulnerabilities. These headers instruct browsers on how to behave when processing your application.

HeaderRecommended ValuePurpose
Content-Security-Policydefault-src 'self'Prevents XSS by controlling resource loading.
X-Frame-OptionsDENYPrevents clickjacking attacks.
Strict-Transport-Securitymax-age=31536000; includeSubDomainsEnforces HTTPS connections.
X-Content-Type-OptionsnosniffPrevents MIME type sniffing.
Referrer-Policystrict-origin-when-cross-originLimits referrer information leakage.

API Security Best Practices

Modern applications rely heavily on APIs. Securing them requires attention to authentication, authorization, input validation, and rate limiting.

Authentication

Do:

Use OAuth 2.0 / OIDC, implement MFA, rotate API keys regularly.

Don't:

API keys in URLs, static tokens, no rate limiting.

Authorization

Do:

Scope-based permissions, RBAC, resource-level access control.

Don't:

Admin endpoints public, horizontal privilege escalation.

Input Validation

Do:

Validate all input, use schemas, whitelist allowed values.

Don't:

Trust client data, no schema validation, string concatenation.

Rate Limiting

Do:

Per-API key limits, exponential backoff, circuit breakers.

Don't:

No limits, same limits for all endpoints, no abuse detection.

Critical Web Application Vulnerabilities

Understanding the most common vulnerabilities helps prioritize security testing and remediation efforts.

Injection

Untrusted data interpreted as code/command (SQL, NoSQL, OS, LDAP).

Example: User input ' OR '1'='1 in login form alters SQL query logic.
Defense: Parameterized queries, ORM, input validation, least privilege DB accounts.

Broken Authentication

Session management flaws allowing credential stuffing or session hijacking.

Example: Session not invalidated after password change; long-lived JWT tokens.
Defense: MFA, secure cookie flags, session timeout, passwordless auth.

Sensitive Data Exposure

Inadequate protection of sensitive data at rest or in transit.

Example: Storing passwords in plaintext or with weak hashing (MD5, SHA1).
Defense: AES-256 for data at rest, TLS 1.3, proper key management, tokenization.

XML External Entities (XXE)

Poorly configured XML processors allowing file access or SSRF.

Example: <!ENTITY xxe SYSTEM "file:///etc/passwd"> in uploaded XML.
Defense: Disable DTD processing, use JSON, whitelist allowed entities.

Broken Access Control

Users can act outside their intended permissions.

Example: /api/admin/deleteUser accessible by changing user_id in request.
Defense: Server-side authorization checks, deny-by-default, API gateway policies.

Key Takeaways

  • Defense in depth across network, server, application, and data layers.
  • Security headers provide browser-side protection against XSS, clickjacking, and more.
  • API security requires authentication, authorization, and rate limiting at minimum.
  • OWASP Top 10 vulnerabilities remain the primary attack vectors—test for them regularly.
Module 10 of 20
Penetration TestingNext: Wireless & Network Security