Web Security Fundamentals
Learn how attacks on web applications work and how to defend against them, from XSS and CSRF to injection and insecure cookies.
The internet is a rough place. Robots, spies, states and hackers constantly look for vulnerable web applications to attack, so every developer needs to know how to protect theirs.
In this hands-on workshop you learn how the web works, how attacks are performed and how to protect your applications. It goes beyond the OWASP Top 10, with many concrete examples of how applications fail and how to prevent it.
What You Will Learn
- Defend against XSS, CSRF, injection attacks and other common web vulnerabilities
- Attack and defend real applications in hands-on exercises
- Secure cookies, sessions, certificates and dependencies against real-world attacks
- Apply what you learn on any platform: .NET, Java, PHP or another stack
Who Is This Workshop For?
Developers, testers and architects who want to build and maintain secure applications. The workshop is platform- and language-independent, so it is relevant to anyone who builds for the web. It suits organizations that handle sensitive data or user information, such as software companies, finance, healthcare, e-commerce and the public sector.
No prior security experience is needed. The workshop works for both beginners and experienced developers.
Prerequisites
- Basic web development experience, including HTML, CSS and JavaScript
- A general understanding of how web applications work
- Some experience with the HTTP protocol, including methods, headers and cookies
Workshop Agenda
During the workshop, we cover the following topics.
Introduction
- Why do we need web security?
- Protecting your users and their data
- Social Engineering
- Goals and focus
Character Encoding
- The problem with characters
- Character sets
- Unicode
- Encodings (UTF-8 and UTF-16)
HTTPS
- The problem with HTTP
- HTTPS (Protocols and Ciphers)
- HTTP -> HTTPS Problem
- HTTP Strict Transport Security Header
Certificates
- Certificate Authority
- Certificate lifetime
- Certificate pinning
- Mutual TLS (mTLS)
- Certificate renewal
Cross-Site Scripting (XSS)
- Reflected XSS
- Self XSS
- Stored XSS
- Data Sanitation
- Mutation XSS
Content Security Policy (CSP)
- Policies and directives
- Creating policies
- CSP Reporting
- CSP in production
- Strict CSP
Cross-Site Request Forgery (CSRF)
- Understanding Cookies
- The CSRF Attack
- How to secure against CSRF
Securing Our Cookies
- HttpOnly & Secure
- Prefixed cookie names
- CHIPS and partitioned cookies
SameSite Cookies
- Why do we need it?
- How to set
- Strict, Lax, None
Securing our Dependencies
- Typosquatting
- Source control attacks
- Build server
- Subresource Integrity
Injection attacks
- SQL Injection
- Blind SQL injection
- Code injection
- XML injection attacks
- File inclusion attacks
Securing the Session
- Detecting stolen cookies
- Fingerprinting
- Cookie Confusion
- Multi-Factor Authentication (MFA)
- Mobile Authenticators
Denial-of-Service attacks
- Attacking the application
- Attacking XML
- Attacking Regular Expressions
How do we make a secure web site?
- Trust boundaries
- Zero-trust
- Hack yourself!
- Honeypots
Web Security FAQ
Here are answers to frequently asked questions about this workshop.
Do I need to install any software on my computer?
No, there’s no need to install any software. Each participant in this workshop will receive access to a Windows-based virtual machine, where all hands-on exercises will take place. You’ll only need to connect to this virtual machine via remote desktop, making it easy to participate without concerns about local restrictions on your computer or network. This setup allows me to create a consistent, ready-to-use environment for all participants.
Why a remote machine instead of local labs?
All exercises are performed in a dedicated Windows-based virtual machine to ensure a consistent and reliable training environment. When running labs locally, corporate firewalls, endpoint protection, proxies, or other security controls may block or interfere with the attack simulations used in the workshop. By using a controlled remote environment, I avoid these issues and ensure that all participants can complete the exercises without disruptions caused by local network restrictions or security policies.
How can I test if I can connect to the virtual machine?
If you’d like to verify your connection capabilities before the workshop, please contact me, and I’ll provide a test machine for you to try connecting to. Testing this in advance is recommended to ensure that your network allows outgoing remote desktop connections, so we don’t encounter any connectivity issues when the workshop starts.
What if I have a Mac or Linux computer?
If you’re using a Mac or Linux computer, you’ll need to be familiar with connecting to a Windows-based virtual machine via remote desktop before the workshop. Here are some recommended resources to help you set up a remote desktop connection:
- Remmina – Linux remote desktop client.
- How to Use Remote Desktop in Linux or macOS to Connect to Windows 10
- Windows App – Mac App Store
Setting up ahead of time will ensure a smooth experience when connecting to the virtual machine during the workshop. Please note that I am unable to provide technical support for Mac or Linux setups.
What do I need to do before the workshop?
Send me any specific questions you’d like covered in the class. Be sure to read the welcome letter you’ll receive before the workshop. A large monitor is recommended so that you can view the exercise document (provided as a PDF) alongside the remote machine while doing the exercises.
Is there any programming involved?
No, this workshop does not require programming. The focus is on understanding web application security, without tying it to a specific platform, implementation, or language.
What Is Included?
When you take the Web Security Fundamentals workshop, you get:
- Workshop Material:
I wrote the material myself and update it regularly to follow current practice. You get the presentation and the exercises as PDF, and on-site participants also get the exercises printed on paper. - Hands-On Exercises:
You learn by doing, in practical exercises on a dedicated server. - Ongoing Support:
During and after the workshop, access a private chat for additional resources, questions, and updates. - Live and Interactive Sessions:
Ask questions in real time via chat or audio and get immediate clarification. I also give live demonstrations.
About the Trainer
My name is Tore Nestenius. I teach on-site and remotely, both directly for companies and through training companies in Europe. What I bring:
- I have trained developers since 2010 and taught several hundred courses and talks.
- I create, maintain and teach every course myself, and improve it after every delivery.
- I am a Microsoft .NET MVP.
- I am the author of two video courses on Dometrain, on authentication and authorization in .NET and on OpenID Connect.
- I speak at conferences such as NDC, Øredev and Swetugg.
- I co-founded Edument, a Swedish training and consulting company, where I was CTO, developer and trainer.
- I work as an independent senior .NET consultant, so I teach from real projects.
- I have worked as a developer for more than 25 years, and with .NET since it launched in 2002.
- I co-founded the .NET Skåne user group.
Web Security Fundamentals
Duration
2 days or 4 half days
Level
Beginner
Language
English, Swedish
Training FAQs
Do you provide both on-site and remote training classes?
Yes, I provide both types of training.
Do you provide training in both Swedish and English?
Yes, both options are available. All my course materials are in English and I can teach the class in either Swedish or English.
Do you do half-day training?
When I run on-site, I usually do full-day classes. For remote training, I can provide options for both half and full days.
Do you do webinars and shorter talks?
Yes, please visit my Talks page for more details.
Do you provide customized courses?
Yes, I do. Contact me for more information.