Secure Coding Attack Lab

Hands-On Application Security and PCI DSS Workshop - 2 days

Modern applications depend on web interfaces, APIs, databases, authentication services, client-side code and cryptographic components. Weaknesses in these areas can expose sensitive data, enable unauthorised access and compromise transactions.

This two-day hands-on workshop covers key application attack categories relevant to PCI DSS Requirement 6. The labs use selected examples from .NET, Node.js, Java, Flutter, Golang and SAS where relevant. The focus is on common secure coding principles, not separate language-specific deep dives. Participants examine vulnerable applications, reproduce selected attacks, identify root causes, apply secure coding fixes and validate remediation through retesting.

Learning Outcomes

Participants will be able to:

Set up and use a controlled application-security testing environment.
Map web, API, mobile and data-processing attack surfaces.
Identify and reproduce common injection vulnerabilities.
Detect weaknesses in data handling, object binding, files and deserialization.
Recognise common cryptographic and secret-management weaknesses.
Test business-logic, XSS and CSRF vulnerabilities.
Identify authentication, session and access-control weaknesses.
Test for privilege escalation, IDOR and BOLA.
Apply secure coding corrections using patterns relevant to .NET, Node.js, Java, Flutter, Golang and SAS.
Validate and document remediation results.

Prerequisites

Basic software-development or application-support experience
Familiarity with HTTP requests, responses and web applications
Basic understanding of APIs and database-backed applications
Ability to read code in at least one common programming language such as .NET, Node.js, Java, Flutter/Dart, Golang or SAS
Basic command-line skills
Administrator access to the supplied lab workstation or virtual machine
A laptop capable of running the designated lab environment
No previous penetration-testing experience required

Training Outline

1. Lab Setup and Attack-Surface Mapping

1.1 Lab Environment

Vulnerable application overview
Local application and database services
Test users and roles
Application reset and recovery
Overview of where .NET, Node.js, Java, Flutter, Golang and SAS commonly appear in enterprise application architectures

1.2 Security Testing Tools

Browser developer tools
Intercepting proxy
API client
Command-line request tools
Source-code editor

1.3 Attack-Surface Mapping

Web routes
API endpoints
HTTP methods
Parameters
Headers
Cookies
Request bodies
Authentication boundaries
Role and permission boundaries
Client-side trust boundaries
Mobile client-to-API boundaries relevant to Flutter
Backend service boundaries relevant to .NET, Node.js, Java and Golang
Data-processing and reporting boundaries relevant to SAS

2. Injection Attacks and Secure Input Handling

2.1 SQL Injection

Query parameter manipulation
Form-input manipulation
Authentication query weaknesses
Unsafe dynamic queries
Parameterised query remediation
Remediation verification
Examples relevant to .NET, Node.js, Java, Golang and SAS

2.2 Command Injection

Unsafe operating-system command construction
Shell metacharacter handling
Argument injection
Safe process execution
Command allow-listing
Corrective testing
Examples relevant to .NET, Node.js, Java and Golang

2.3 LDAP and XPath Injection

LDAP injection overview
XPath injection overview
Template injection overview
Unsafe query construction
Input escaping
Safe query handling

2.4 Secure Coding Controls

Input validation
Parameterised operations
Allow-listing
Least-privilege database access
Negative testing
Regression testing

3. Data Handling, Object Binding and File Processing

3.1 Unsafe Input and Data Handling

Missing validation
Malformed input
Boundary-value manipulation
Invalid data types
Truncation risks
Secure error handling

3.2 Mass Assignment and Object Binding

Automatic request-to-object mapping
Hidden properties
Privileged properties
Over-posting
Data-transfer objects
Explicit property mapping
Property-level authorisation
Examples relevant to .NET, Node.js, Java and Golang

3.3 Insecure Deserialization

Untrusted serialized input
Unsafe object reconstruction
Polymorphic object handling
Trusted-type allow-listing
Schema-restricted formats
Secure replacement patterns

3.4 File and Data Processing

File-name manipulation
Path traversal
Content-type trust
File-size validation
Temporary-file handling
Secure storage boundaries

4. Business Logic, Client-Side and API Abuse

4.1 Business-Process Mapping

Intended transaction sequence
Required approvals
State transitions
Trust assumptions
Server-side enforcement points

4.2 Workflow Manipulation

Step skipping
Out-of-order operations
Request replay
Duplicate submissions
Partial-completion abuse

4.3 Parameter and Value Manipulation

Price manipulation
Quantity manipulation
Discount manipulation
Negative values
Extreme values
Hidden-field manipulation
Server-side value calculation
Flutter mobile client trust boundaries

Day 2

5. Secrets, Passwords and Cryptography Misuse

5.1 Password Protection

Plaintext password storage
Reversible password storage
Weak password hashes
Password-hashing functions
Salt generation
Work-factor configuration

5.2 Hard-Coded Credentials and Secrets

Embedded passwords
API keys in source code
Configuration-file secrets
Log and diagnostic leakage
Secret scanning
Secure secret injection

5.3 Encryption in Transit

TLS configuration
Certificate validation
Hostname verification
Trust-store handling
Insecure protocol fallback

5.4 Token and Randomness Weaknesses

Predictable tokens
Weak session identifiers
Improper signing
Missing integrity checks
Secure token generation

5.6 Cryptographic Remediation

Approved algorithms
Secure cryptographic libraries
Key separation
Secret rotation
Secure failure handling
Remediation verification

6. XSS, CSRF and Client-Side Security

6.3 Client-Side Security

Local storage exposure
Browser token storage
Source-map exposure
Client-side secret exposure
Flutter mobile local storage and token-handling risks
Server-side validation requirements

7. Attacks on Access-Control Mechanisms

7.1 Identification, Authentication and Authorisation

User identification
Credential validation
Role verification
Permission enforcement
Policy decision points
Policy enforcement points

7.2 Authentication Weaknesses

Default credentials
Username enumeration
Password-reset weaknesses
Multi-factor bypass
Account-lockout weaknesses
Missing rate limiting

7.3 Session and Token Weaknesses

Session fixation
Session-token predictability
Token reuse
Missing logout invalidation
Missing session rotation
Weak cookie attributes
Improper token validation

7.4 Horizontal Privilege Escalation

User-to-user data access
Identifier substitution
Cross-account actions
Resource ownership checks
Tenant-isolation testing

7.5 Vertical Privilege Escalation

User-to-administrator access
Restricted function invocation
Role-parameter manipulation
Privileged route access
Server-side permission enforcement

7.6 IDOR and BOLA

Sequential identifiers
Predictable identifiers
Object-identifier manipulation
Read access testing
Update access testing
Delete access testing
Per-object authorisation

7.7 Access-Control Remediation

Centralised authorisation
Deny-by-default policies
Consistent middleware enforcement
Role-permission matrices
Negative authorisation testing
Privilege regression testing

8. Secure Remediation and Retesting Workshop

8.1 Vulnerability Triage

Reproduction reliability
Attack preconditions
Exploitability
Data exposure
Business impact
Root-cause classification

8.2 Secure Coding Corrections

Input validation
Parameterised operations
Context-aware output encoding
Explicit object binding
Centralised authorisation
Secure cryptographic APIs
Safe error handling
Least-privilege execution

8.3 Fix Validation

Original attack replay
Negative testing
Boundary testing
Alternate payload testing
Role-based regression testing
API regression testing

Disclaimer

This training outline is provided as a proposed instructional framework and may be refined, reordered, expanded or otherwise amended by the trainer to accommodate participant experience, technical constraints, organisational priorities, lab progress and emerging industry practices. Such adjustments may be made at the trainer’s professional discretion without prior notice, provided that the overall learning objectives and intended practical character of the programme are preserved.

Practical, connected learning

My wider training approach brings hands-on implementation and systems thinking together, connecting technology with real operational needs.

Secure Coding Attack Lab