Security Testing for Developers

Most security vulnerabilities aren't created by attackers. They're introduced by well-meaning developers, one unvalidated input, one missing authorization check, or one misplaced assumption about the client at a time. This course is designed to change that.

Security Testing for Developers is a hands-on, practical course that teaches you to see your own code the way an attacker would. Over three days, you'll learn how common web vulnerabilities work, why they occur, how to exploit them in a safe lab environment, and, most importantly, how to prevent them in the code you write every day.

The course covers the OWASP Top 10 risks most relevant to developers, including injection, cross-site scripting (XSS), broken access control, and API security flaws. You'll intercept and manipulate live HTTP traffic, exploit deliberately vulnerable applications, and then step back into the developer's seat to apply secure coding practices that stop these attacks at the source. The final day focuses on integrating security into the development lifecycle ("shift-left"), covering threat modeling, secure code reviews, and the strengths and limits of automated tooling. The course closes with a capstone lab in which you assess a sample application and present your findings.

Concepts are taught in a framework-agnostic way so they apply wherever you work, with Angular and .NET used as illustrative examples throughout.

What You Will Learn

By the end of this course, you will be able to:

• Explain common web vulnerabilities (OWASP Top 10) and their real-world impact.

• Apply secure coding practices, such as server-side validation, output encoding, least privilege, and secure error handling.

• Adopt an attacker mindset by identifying attack surfaces and trust boundaries.

• Perform basic manual security testing using traffic interception and request manipulation.

• Integrate security into the development lifecycle through threat modeling, secure code review, and early testing.

• Write clear, actionable vulnerability reports.

Target Audience

This course is intended for:

• Software developers (front-end, back-end, and full-stack) who want to build more secure applications.

• Technical leads and architects who review code and make design decisions affecting security.

• QA engineers and testers looking to extend their skills into security testing.

• DevOps and platform engineers who want to understand how security fits into delivery pipelines.

No prior security experience is required. The course is aimed at builders, not professional penetration testers.

Prerequisites

Required:

• Working knowledge of at least one programming language used in web development.

• Basic understanding of web applications, including client/server architecture and how APIs are consumed.

• Familiarity with HTTP concepts such as requests, responses, methods, and status codes.

• Comfort using a browser's developer tools and working with JSON.

Helpful but not required:

• Experience with Angular and/or .NET, since examples use these technologies, though the concepts transfer to any stack.

• Basic familiarity with SQL and relational databases.

• Exposure to a software development lifecycle or CI/CD practices.

Key Takeaway Principles

Throughout the course, a few ideas are reinforced repeatedly:

• Never trust client input.

• Security must be enforced on the server.

• Most vulnerabilities stem from logic flaws, not just syntax mistakes.

• Attackers interact directly with APIs, bypassing your UI entirely.

• Security is part of development, not an afterthought.

Course Outline

Module 1: Introduction to Security for Developers

• Why security matters.

• Real-world impact of vulnerabilities.

• Developer’s role in security.

Module 2: Thinking Like an Attacker

• Attacker mindset and behavior.

• Identifying attack surfaces.

• Trust boundaries.

Module 3: Web Application Fundamentals

• HTTP request/response lifecycle.

• Authentication vs Authorization.

• Client vs server responsibilities.

Module 4: OWASP Top 10 Overview

• High-level overview of key risks:

  • Broken Access Control.

  • Injection.

  • XSS.

  • Security Misconfiguration.

  • Authentication Failures.

• Common developer mistakes leading to vulnerabilities.

Module 5: Introduction to Security Testing Tools

• Intercepting HTTP traffic.

• Modifying requests.

• Observing application behavior.

Lab 1: Traffic Interception & Manipulation

• Capture HTTP requests.

• Modify parameters.

• Replay requests to backend.

Module 6: Injection Vulnerabilities

• SQL Injection.

• Command Injection.

• Root causes and prevention.

Developer Focus:

• Unsafe query construction.

• Input handling mistakes.

Lab 2: Exploiting Injection

• Bypass input validation.

• Extract unintended data.

Module 7: Cross-Site Scripting (XSS)

• Stored, Reflected, DOM-based XSS.

• Impact and exploitation.

Developer Focus:

• Output encoding.

• Safe rendering practices.

• Angular-specific notes (sanitization limits).

Lab 3: XSS Exploitation

• Inject script payloads.

• Observe execution.

Module 8: Broken Access Control

• IDOR (Insecure Direct Object Reference).

• Privilege escalation.

Developer Focus:

• Missing backend authorization.

• Trusting client input.

Lab 4: Access Control Bypass

• Access unauthorized data.

• Modify resource identifiers.

Module 9: API Security

• Common API vulnerabilities:

  • Missing authentication.

  • Excessive data exposure.

  • Mass assignment.

Developer Focus:

• Input binding issues (.NET example).

• Hidden fields (Angular example).

Lab 5: API Manipulation

• Modify JSON payloads.

• Discover unintended behavior.

Module 10: Secure Coding Practices

• Input validation (server-side).

• Output encoding.

• Principle of least privilege.

• Secure error handling.

• Secure defaults.

Module 11: Security in the Development Lifecycle

• Where security fits in SDLC.

• Cost of late vs early detection.

Module 12: Shift-Left Security

• Definition and benefits.

• Practical implementation:

  • Secure code reviews.

  • Early testing.

  • Developer responsibility.

Module 13: Basic Threat Modeling

• Identifying assets.

• Identifying threats.

• Mapping attack vectors.

Module 14: Security Testing Approaches

• Manual vs automated testing.

• Overview of:

  • SAST.

  • DAST.

  • Dependency scanning.

Limitations of tools:

• Why tools miss logic flaws.

Module 15: Secure Code Review Mindset

• What to look for:

  • Trust boundaries.

  • Input validation.

  • Authorization checks.

Module 16: Reporting Vulnerabilities

• Writing clear security reports:

  • Title.

  • Severity.

  • Steps to reproduce.

  • Impact.

  • Suggested fix.

Capstone Lab: Mini Security Assessment

• Analyze a sample application.

• Identify multiple vulnerabilities.

• Document findings.

• Present results.

• Supporting Examples (throughout the course).

Angular Examples

• Client-side validation bypass.

• DOM-based XSS edge cases.

• Token storage risks.

.NET Examples

• Missing authorization checks.

• Over-posting / mass assignment.

• Misconfigured APIs.

Key Principles Reinforced

• Never trust client input.

• Security must be enforced on the server.

• Most vulnerabilities come from logic flaws.

• Attackers interact directly with APIs.

• Security is part of development, not an afterthought.