Day 1: Web Hacking Fundamentals

Module 1: Introduction to Web Security and OWASP Top 10

Activity 1: Animation

How a web request flows between client, server, and database, and how attackers intercept or manipulate it?

Activity 2: Animation

Discuss real-world breaches caused by OWASP Top 10 vulnerabilities (e.g., Equifax breach due to A03: Injection)

Module 2: Injection Attacks (A03: Injection)

Activity 3: Hands-on Labs & Exercise

Activity 4: Animation

Show how malicious SQL queries bypass authentication and retrieve sensitive data.

Module 3: Broken Authentication (A07: Identification and Authentication Failures)

Activity 5: Animation

Module 4: Cross-Site Scripting (XSS) (A03: Injection)

Activity 6: Hands-on Labs & Exercise

Use DVWA or OWASP Juice Shop to inject malicious scripts
Animation: Show how a malicious script is injected into a web page and executed in a victim's browser.
Exercise: Cookie session ID stealing.

Module 5: Cross-Site Request Forgery (CSRF) (A01: Broken Access Control)

Activity 7: Hands-on Labs & Exercise

Day 2: Web Defence and Secure Coding

Module 6: Secure Coding Practices

Activity 8: Hands-on Labs & Exercise

Module 7: Web Application Firewalls (WAFs)

Activity 9: Hands-on Labs & Exercise

Module 8: Secure Authentication and Session Management

Implementing strong password policies and MFA.
Secure session management techniques (e.g., secure cookies, session expiration).

Activity 10: Hands-on Labs & Exercise

Module 9: Security Testing and Tools

Activity 11: Hands-on Labs & Exercise

Module 10: Capture the Flag (CTF) Challenge

Demo Hands-on CTF challenge covering selected topics.
Participants work in teams to find and exploit vulnerabilities in a simulated environment.

Activity 12: Hands-on Labs & Exercise

OWASP-YN: Web Hacking and Defense Course with OWASP Top 10 Vulnerabilities