Web security: Injection Attacks with Java & Spring Boot

Web security: Injection Attacks with Java & Spring Boot, available at $74.99, has an average rating of 4.35, with 78 lectures, 26 quizzes, based on 161 reviews, and has 2785 subscribers.

You will learn about Ethical hacking with injection attacks Web security Secure coding SQL Injection with PostgreSQL NoSQL Injection with MongoDB LDAP Injection with OpenLDAP LOG Injection CSV Injection Spring security Form login authentication Spring Data JPA Spring Data MongoDB Spring LDAP Spring Validation This course is ideal for individuals who are Developers keen on web security, ethical hacking and secure coding or One wants to dive into injection vulnerability with different attack types or One likes to learn with a hands-on approach It is particularly useful for Developers keen on web security, ethical hacking and secure coding or One wants to dive into injection vulnerability with different attack types or One likes to learn with a hands-on approach.

Enroll now: Web security: Injection Attacks with Java & Spring Boot

Summary

Title: Web security: Injection Attacks with Java & Spring Boot

Price: $74.99

Average Rating: 4.35

Number of Lectures: 78

Number of Quizzes: 26

Number of Published Lectures: 78

Number of Published Quizzes: 26

Number of Curriculum Items: 104

Number of Published Curriculum Objects: 104

Original Price: €94.99

Quality Status: approved

Status: Live

What You Will Learn

Ethical hacking with injection attacks
Web security
Secure coding
SQL Injection with PostgreSQL
NoSQL Injection with MongoDB
LDAP Injection with OpenLDAP
LOG Injection
CSV Injection
Spring security Form login authentication
Spring Data JPA
Spring Data MongoDB
Spring LDAP
Spring Validation

Who Should Attend

Developers keen on web security, ethical hacking and secure coding
One wants to dive into injection vulnerability with different attack types
One likes to learn with a hands-on approach

Target Audiences

Developers keen on web security, ethical hacking and secure coding
One wants to dive into injection vulnerability with different attack types
One likes to learn with a hands-on approach

Are you a Java web developer and want to write secure code? Do you want to learn Ethical hacking and Web application security? With this hands-on injection attacks course you will start learning web security using one of the top vulnerabilities of OWASP Top 10 list. Injection attack is still listed in top 3 attacks in the OWASP Top 10 and it is important to prevent against injection attacks to develop secure web applications.

Krzysztof Telka: “Nice examples, where the host is presenting step by step how to exploit the application and then how to prevent. Lot of nice tools, features to check and examine the web page in case of hackers attack. CSV/Log4J/SQL made big wow effect on my face. The atendeers they will not be dissapointed Great job Ali, Thank you!”

You can always use the latest versions for spring boot, and other dependencies in this course. I will be constantly updating the dependency version in the last section’s lectures. You may check that to see the required code and configuration changes for updated versions. Also if you would like to use subtitles during the course, you can turn on the captions on videos. I suggest using subtitles to make it easier to follow the lectures.

As part of the blue and red security teams,I have a practical knowledge and I am here to help you learn the injection vulnerability in detail

In this course, you will focus on different type of injection attacks;

SQL Injection
NoSQL injection
LDAP injection
LOG injection
CSV injection

Ethical hacking and Web application security are the two important subjects of Cyber Security field and having practical knowledge about Injections will enable you to better understand the security concepts and make a quick start.

In this course you will follow defense-in-depth principle and apply multiple solutions to each vulnerability to secure the web application in multiple layers.

You will follow a hands-on approach. You will not only learn how to exploit an application using different kind of injection attacks, but also develop the vulnerable applications from scratch in which you will have a common web login module with Thymeleaf and Bootstrap for a basic front-end, with Spring security form login authentication & authorisation, and with separate applications for SQL, NoSQL and LDAP injections.

The applications will be developed using Java, Spring boot and Spring Data along with the most used data sources, such as PostgreSQL for SQL Injection, MongoDB for NoSQL injection and OpenLDAP for LDAP injection.

In each section there will be;

Development of the vulnerable web application using Java, Spring boot and Spring security
Hacking of the application with various attack payloads and with Ethical hacking examples
Protection steps and the implementations to prevent injection attacks

At the end of the course you will understand the different type of injection vulnerabilities, perform injection attacks against the vulnerable web applications you have developed, and learn how to protect your applications against the injection attacks using various techniques such as,

Validation and sanitisation using white list approach
Parametrised queries with prepared statements
Escaping output
Using secure trusted libraries
Error handling and logging
General coding practices

If you want to skip the development and only perform the hacking of applications, you can jump into the injection lectures and download the source code provided in the resources section of that lecture. The source codes are in lecture 20 (SQL Injection), lecture 38 (NoSQL Injection), lecture 51 ( LDAP Injection), lecture 60 (LOG Injection) and lecture 74 (CSV Injection). Be aware that you will still need to install PostgreSQL for SQL Injection, MongoDB for NoSQL injection and OpenLDAP docker container for LDAP injection. You can see how to install and configure these data sources in the beginning lectures of each injection section.

Manoj Singh: “Talented instructor and great course!!! Just a small suggestion, If you could add a chapter about “Broken Access Control” topic that will be a great help.”

For more detailed information on the progress of this course, you can check the introductory video and free lessons, and if you decide to enroll in this course, you are always welcome to ask and discuss the concepts and implementation details on Q/A and messages sections. I will guide you from start to finish to help you successfully complete the course and gain as much knowledge and experience as possible from this course.

Remember!There is a 30-day full money-back guarantee for this course! So you can safely press the ‘Buy this course’ button with zero risk and join this learning journey with me.

Course Curriculum

Chapter 1: Introduction

Lecture 1: Why to learn Secure coding principles & Web security?

Lecture 2: Structure of the course

Lecture 3: Setting up the environment

Chapter 2: Creating the common web login module with Spring security

Lecture 1: Adding the base pom.xml with basic maven dependencies

Lecture 2: Creating common login module with dependencies, thymeleaf templates & bootstrap

Lecture 3: Creating the package structure and adding interfaces

Lecture 4: Adding authentication provider and user details to customise form authentication

Lecture 5: Adding web security configuration for Spring security form login authentication

Lecture 6: Adding API endpoints

Lecture 7: Adding Custom Error Controller

Chapter 3: SQL Injection

Lecture 1: Introduction to Injections

Lecture 2: Explaining SQL injection

Lecture 3: Creating SQL Injection application with dependencies and configuration

Lecture 4: Adding PostgreSQL init files, packages and validator implementation

Lecture 5: Implementing Spring Data JPA entities

Lecture 6: Adding Spring Data JPA repository interfaces

Lecture 7: Implementing Spring Data JPA repository

Lecture 8: Adding SQL injection user detail service implementation

Lecture 9: Implementing user service interface

Lecture 10: Hacking SQL Injection application using login form with Http Post – Part 1

Lecture 11: Hacking SQL Injection application using login form with Http Post – Part 2

Lecture 12: Hacking SQL Injection application with Http Get – Part 1

Lecture 13: Hacking SQL Injection application with Http Get – Part 2

Lecture 14: Hacking SQL Injection application with Http Get – Part 3 – Using Burp Suite

Lecture 15: Extending Http Get vulnerability to read system files – Part 1

Lecture 16: Extending Http Get vulnerability to read system files – Part 2

Lecture 17: Preventing Sql injection: Validation and Sanitisation

Lecture 18: Preventing Sql injection: Using Prepared statements

Lecture 19: Preventing Sql injection: Summary

Lecture 20: A final attack using a vulnerable SQL function

Chapter 4: NoSQL Injection

Lecture 1: Explaining NoSQL injection

Lecture 2: Adding NoSQL injection module with dependencies using MongoDB

Lecture 3: Adding configuration and init data file

Lecture 4: Adding packages and validator implementation

Lecture 5: Implementing mongoDB configuration

Lecture 6: Adding repository interfaces

Lecture 7: Implementing repository and adding service layer classes

Lecture 8: Hacking NoSQL injection application: Using login form

Lecture 9: Hacking NoSQL injection: Using user info endpoint with Regex

Lecture 10: Preventing NoSQL injection: Validation and sanitisation

Lecture 11: Preventing NoSQL injection: Using criteria Api

Lecture 12: Preventing NoSQL injection: Using JPA repository

Chapter 5: LDAP Injection

Lecture 1: Explaining LDAP injection

Lecture 2: Adding LDAP injection module with LDAP schema file

Lecture 3: Adding dependencies,configuration and startup file to initialisatize LDAP schema

Lecture 4: Creating packages and adding Spring boot starter class to initialise LDAP data

Lecture 5: Creating entity and validation implementations, and repository interfaces

Lecture 6: Adding LDAP helper class for LDAP operations

Lecture 7: Completing the user repository implementation

Lecture 8: Completing the user role repository and service implementation

Lecture 9: Hacking LDAP injection – Part 1

Lecture 10: Hacking LDAP injection – Part 2

Lecture 11: Preventing LDAP injection: Validation and sanitisation

Lecture 12: Preventing LDAP injection: Using secure libraries

Chapter 6: LOG Injection

Lecture 1: Explaining LOG injection

Lecture 2: Adding a new endpoint to use in LOG injection attacks

Lecture 3: Adding log data endpoint and thymeleaf template to view logs by admin user

Lecture 4: Adding Logback configuration

Lecture 5: Creating the attacker application

Lecture 6: Hacking LOG injection with Line Feed

Lecture 7: Hacking LOG injection with Carriage Return

Lecture 8: Hacking LOG injection: XSS attack – Part 1

Lecture 9: Hacking LOG injection: XSS attack – Part 2

Lecture 10: Preventing LOG injection: Validation and using trusted libraries protections

Lecture 11: Preventing LOG injection: XSS attacks

Chapter 7: CSV Injection

Lecture 1: Explaining CSV injection

Lecture 2: Adding new interfaces

Lecture 3: Adding user detail Api methods for CSV injection

Lecture 4: Adding export user details Api method for CSV injection

Lecture 5: Adding data access implementation classes

Instructors

Ali Gelenler
Senior Software Engineer | Tech Lead
EA Algorithm
IT Training and Consulting

Rating Distribution

1 stars: 3 votes
2 stars: 2 votes
3 stars: 13 votes
4 stars: 53 votes
5 stars: 90 votes

Frequently Asked Questions

How long do I have access to the course materials?

You can view and review the lecture materials indefinitely, like an on-demand channel.

Can I take my courses with me wherever I go?

Definitely! If you have an internet connection, courses on Udemy are available on any device at any time. If you don’t have an internet connection, some instructors also let their students download course lectures. That’s up to the instructor though, so make sure you get on their good side!

Menu