You, This Course and Us

What is XSS?

Learn by example – how does a XSS attack work?

Types of XSS

XSS mitigation and prevention

Sanitizing input

Sanitizing input – still not done

Validating input

Validating input – some more stuff to say

Client Side Encoding, Blacklisting and Whitelisting inputs

Rules for the browser

Default directives and wildcards

Stay away from inline code and the eval() function

The nonce attribute and the script hash

Broken authentication and session management

All about passwords – Strength, Use and Transit

All about passwords – Storage

Learn by example – login authentication

A little bit about hashing

All about passwords – Recovery

What is a session?

Anatomy of a session attack

Session hijacking – count the ways

Learn by example – sessions without cookies

Session ids using hidden form fields and cookies

Session hijacking using session fixation

Session hijacking counter measures

Session hijacking – sidejacking, XSS and malware

Who Is Bobby Tables?

Learn by example – how does SQLi work?

Anatomy of a SQLi attack – unsanitized input and server errors

Anatomy of a SQLi attack – table names and column names

Anatomy of a SQLi attack – getting valid credentials for the site

Types of SQL injection

SQLi mitigation – parameterized queries and stored procedures

SQLi mitigation – Escaping user input, least privilege, whitelist validation

What is XSRF?

Learn by example – XSRF with GET and POST parameters

XSRF mitigation – The referer, origin header and the challenge response

XSRF mitigation – The synchronizer token

The Open Web Application Security Project Preview

2 factor authentications and OTPs

Social Engineering

The direct object reference attack – do not leak implementation details

Direct object reference mitigations

IFrames come with their own security concerns

Sandboxing iframes

Wrapping up the OWASP top 10 list

Installing PHP (Windows)

Enabling MySQL and using phpmyadmin (Windows)

Installing PHP (Mac)

Installing MySQL (Mac)

Using MySQL Workbench (Mac)

Getting PHP and MySQL to talk to each other (Mac)