Web Application Security: 9 Key Steps to Go from Zero to Operational
Web Application Security: The Essentials in One Article — Real Code, Diagrams and Concrete Steps, Excerpts from a 45-Lesson Course.
Everyone can learn Web Application Security — provided they follow the steps in the right order. We have condensed a complete 45-lesson course into a clear path, with the most useful code snippets.
- Introduction and Lab
- OWASP Top 10 and Methodology
- SQL NoSQL Command Injections
- XSS Cross-Site Scripting
- CSRF SSRF and Server-Side Request
Classic SQL injection (UNION, error-based)
Learning objectives
- Explain why an SQLi is possible
- Detect an injection with a simple quote
- Exploit a UNION-based injection to read other tables
- Use error messages (error-based)
- Understand the definitive fix: parameterized queries
Why does an SQL injection exist?
An SQLi occurs when user input is concatenated directly into an SQL query. The engine can no longer distinguish code (the query) from data (the input). The attacker then injects SQL that will be executed.
| Payload | Expected behavior if vulnerable |
|---|---|
' | SQL error / 500 |
' OR '1'='1 | Authentication bypass |
1' AND '1'='2 | Empty result (false condition) |
1' AND '1'='1 | Normal result (true condition) |
UNION-based: reading other tables
The UNION SELECT operator allows the results of a second query to be appended to the first. Requirements: same number of columns and compatible types. Start by determining the number of columns with ORDER BY.
OK Secure
JWT: alg=none, cryptographic weaknesses, kid injection
alg=none, weak HS256 secret, RS256/HS256 confusion, injection via the kid header) and apply validation best practices.Learning objectives
- Decode and understand the structure of a JWT
- Exploit the
alg=noneflaw - Crack a weak HS256 secret
- Understand the RS256/HS256 algorithm confusion
- Exploit an injection via the
kidheader
JWT structure
A JWT consists of three base64url-encoded parts separated by dots: header, payload, signature. The header indicates the algorithm, the payload contains the claims (data), and the signature guarantees integrity.
| Algorithm | Signature | Verification |
|---|---|---|
| HS256 | Shared secret | Same secret |
| RS256 | Private key | Public key |
| Confusion | Public key as HS256 | Server incorrectly validates |
Flaw 4: kid injection
The kid header (key ID) indicates which key to use. If used without sanitization to read a file or query a database, an attacker can inject a path (path traversal) or SQL.
Burp Suite Community: first steps
Learning objectives
- Configure the browser to use the Burp proxy
- Install the CA certificate to intercept HTTPS
- Intercept, modify and forward a request
- Replay a request in Repeater
- Navigate the sitemap (Target tab)
What is Burp Suite?
Burp Suite is an interception proxy placed between your browser and the web server. All traffic passes through it: you can view it, modify it on the fly and replay it. It is the central tool for every web pentester. The Community edition is free and more than sufficient for learning.
Repeater
Replay a request as many times as you want while modifying it.
Target
Builds the mapping (sitemap) of the visited application.
Configuring the proxy
By default, Burp listens on 127.0.0.1:8080. You must tell the browser to send its traffic there. The simplest method is Burp’s built-in browser (“Open Browser”), which is preconfigured. Otherwise, configure a manual proxy or use the FoxyProxy extension.
Manual proxy (Firefox)
First workflow: intercept and replay
Here is the basic action you will repeat thousands of times.
| Step | Action |
|---|---|
| 1 | Proxy tab → Intercept “on” |
| 2 | Navigate to the target (e.g. DVWA login) |
| 3 | The request is captured — read it, modify it |
| 4 | Right-click → “Send to Repeater” |
| 5 | In Repeater, change a parameter, click “Send” |
Example: modifying a parameter in Repeater
This article covers the most useful snippets — the complete Web Application Security course (11 chapters, 45 lessons, corrected exercises and final project) takes you all the way.
./access-the-full-course free course: Mastering Claude CodeFAQ
How long does it take to learn Web Application Security?
Are there any prerequisites?
Where to start concretely?
📬 Want to receive this type of guide every week? Subscribe for free — real code, zero fluff.