The Security Mindset and the Rules of Testing

Security is not a feature you add at the end; it is a way of building. This track covers the most common web vulnerabilities, how to find them in your own applications and how to fix them, and how to use automated scanners such as VulnHawk as part of that process.

The legal and ethical rule

Only test systems you own or have written permission to test, within the agreed scope. Scanning or probing other people's sites without permission is illegal in most countries, even with good intentions. For client work, get a signed authorisation that lists domains, dates, allowed techniques and contacts.

Thinking like an attacker

For every feature ask:

• What can a user control? URL parameters, form fields, headers, cookies, uploaded files, JSON bodies.
• What does the app trust? IDs in URLs, hidden fields, prices from the browser, data from other APIs.
• What is valuable? Accounts, payments, personal data, admin access, server access.
• What happens if I change it? Another user's ID, a negative quantity, a script tag, a 10 MB string.

Risk = likelihood × impact

Not every finding is urgent. A reflected XSS on an admin-only page behind 2FA is lower risk than broken access control exposing every customer's invoices. Prioritise by real-world impact and how easy exploitation is.

Defence in depth

Assume any single control can fail, and layer them: validation, parameterised queries, output escaping, authentication and authorisation checks, rate limits, security headers, least-privilege database users, monitoring and backups.

The OWASP Top 10

OWASP publishes the most critical web application risks. Recurring themes: broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, authentication failures, integrity failures, logging gaps and server-side request forgery. The following modules cover each in practice.

Check yourself

• What must you have before testing a system you do not own?
• Name three things a user can control in a request.
• Why is defence in depth necessary?