Secure Coding Attack Lab

Hands-On Application Security and PCI DSS Workshop - 2 days

Modern applications depend on web interfaces, APIs, databases, authentication services, client-side code and cryptographic components. Weaknesses in these areas can expose sensitive data, enable unauthorised access and compromise transactions.

This two-day hands-on workshop covers key application attack categories relevant to PCI DSS Requirement 6. Participants examine vulnerable applications, reproduce selected attacks, identify root causes, apply secure coding fixes and validate remediation through retesting.

Learning Outcomes

Participants will be able to:

Set up and use a controlled application-security testing environment.
Map application and API attack surfaces.
Identify and reproduce common injection vulnerabilities.
Detect weaknesses in data handling, object binding, files and deserialization.
Recognise common cryptographic and secret-management weaknesses.
Test business-logic, XSS and CSRF vulnerabilities.
Identify authentication, session and access-control weaknesses.
Test for privilege escalation, IDOR and BOLA.
Apply secure coding corrections.
Validate and document remediation results.

Prerequisites

Basic software-development or application-support experience
Familiarity with HTTP requests, responses and web applications
Basic understanding of APIs and database-backed applications
Ability to read code in at least one common programming language
Basic command-line skills
Administrator access to the supplied lab workstation or virtual machine
A laptop capable of running the designated lab environment
No previous penetration-testing experience required

Training Outline

1. Lab Setup and Attack-Surface Mapping

1.1 Lab Environment

Vulnerable application overview
Local application and database services
Test users and roles
Application reset and recovery

1.2 Security Testing Tools

Browser developer tools
Intercepting proxy
API client
Command-line request tools
Source-code editor

1.3 Attack-Surface Mapping

Web routes
API endpoints
HTTP methods
Parameters
Headers
Cookies
Request bodies
Authentication boundaries
Role and permission boundaries
Client-side trust boundaries

2. Injection Attacks

2.1 SQL Injection

Query parameter manipulation
Form-input manipulation
Authentication query weaknesses
Unsafe dynamic queries
Parameterised query remediation
Remediation verification

2.2 Command Injection

Unsafe operating-system command construction
Shell metacharacter handling
Argument injection
Safe process execution
Command allow-listing
Corrective testing

2.3 LDAP and XPath Injection

Directory-search filter manipulation
XPath query manipulation
Unsafe query construction
Input escaping
Safe query handling
Guided demonstration

2.4 Secure Coding Controls

Input validation
Parameterised operations
Allow-listing
Least-privilege database access
Negative testing
Regression testing

3. Attacks on Data and Data Structures

3.1 Unsafe Input and Data Handling

Missing validation
Malformed input
Boundary-value manipulation
Invalid data types
Truncation risks
Secure error handling

3.2 Mass Assignment and Object Binding

Automatic request-to-object mapping
Hidden properties
Privileged properties
Over-posting
Data-transfer objects
Explicit property mapping
Property-level authorisation

3.3 Insecure Deserialization

Untrusted serialized input
Unsafe object reconstruction
Polymorphic object handling
Trusted-type allow-listing
Schema-restricted formats
Secure replacement patterns

3.4 File and Data Processing

File-name manipulation
Path traversal
Content-type trust
File-size validation
Temporary-file handling
Secure storage boundaries

3.5 Buffer, Pointer and Shared-Data Risks

Buffer-boundary weaknesses
Integer conversion risks
Null-reference conditions
Shared mutable state
Race-condition concepts
Defensive validation

4. Business Logic Attacks, Part 1

4.1 Business-Process Mapping

Intended transaction sequence
Required approvals
State transitions
Trust assumptions
Server-side enforcement points

4.2 Workflow Manipulation

Step skipping
Out-of-order operations
Request replay
Duplicate submissions
Partial-completion abuse

4.3 Parameter and Value Manipulation

Price manipulation
Quantity manipulation
Discount manipulation
Negative values
Extreme values
Hidden-field manipulation
Server-side value calculation

4.4 Client-Side Validation Bypass

Disabled-control bypass
Front-end role-check bypass
Client-calculated values
Exposed configuration
Server-side control enforcement

4.5 API Manipulation

Request parameter tampering
HTTP method manipulation
Request-body modification
Hidden endpoint access
Server-side validation

Day 2

5. Attacks on Cryptography Usage

5.1 Weak Cryptographic Implementations

Deprecated algorithms
Weak cipher modes
Inadequate key lengths
Improper random-number generation
Static initialization vectors
Reused nonces

5.2 Password Protection

Plaintext password storage
Reversible password storage
Weak password hashes
Password-hashing functions
Salt generation
Work-factor configuration

5.3 Hard-Coded Credentials and Secrets

Embedded passwords
API keys in source code
Configuration-file secrets
Log and diagnostic leakage
Secret scanning
Secure secret injection

5.4 Encryption in Transit

TLS configuration
Certificate validation
Hostname verification
Trust-store handling
Insecure protocol fallback

5.5 Token and Randomness Weaknesses

Predictable tokens
Weak session identifiers
Improper signing
Missing integrity checks
Secure token generation

5.6 Cryptographic Remediation

Approved algorithms
Secure cryptographic libraries
Key separation
Secret rotation
Secure failure handling
Remediation verification

6. Business Logic Attacks, Part 2

6.1 Communication Protocols and Channels

HTTP method restrictions
Header trust
Host-header manipulation
Content-type enforcement
Redirect handling
Secure service communication

6.2 Client-Side Functionality Abuse

JavaScript function invocation
Local storage exposure
Browser token storage
Source-map exposure
Client-side secret exposure
Server-side validation requirements

6.5 Server-Side Enforcement

Trust-boundary validation
Request integrity checks
Server-side business rules
Secure transaction validation
Regression testing

7. Attacks on Access-Control Mechanisms

7.1 Identification, Authentication and Authorisation

User identification
Credential validation
Role verification
Permission enforcement
Policy decision points
Policy enforcement points

7.2 Authentication Weaknesses

Default credentials
Username enumeration
Password-reset weaknesses
Multi-factor bypass
Account-lockout weaknesses
Missing rate limiting

7.3 Session and Token Weaknesses

Session fixation
Session-token predictability
Token reuse
Missing logout invalidation
Missing session rotation
Weak cookie attributes
Improper token validation

7.4 Horizontal Privilege Escalation

User-to-user data access
Identifier substitution
Cross-account actions
Resource ownership checks
Tenant-isolation testing

7.5 Vertical Privilege Escalation

User-to-administrator access
Restricted function invocation
Role-parameter manipulation
Privileged route access
Server-side permission enforcement

7.6 IDOR and BOLA

Sequential identifiers
Predictable identifiers
Object-identifier manipulation
Read access testing
Update access testing
Delete access testing
Per-object authorisation

7.7 Access-Control Remediation

Centralised authorisation
Deny-by-default policies
Consistent middleware enforcement
Role-permission matrices
Negative authorisation testing
Privilege regression testing

8. Secure Remediation and Retesting Workshop

8.1 Vulnerability Triage

Reproduction reliability
Attack preconditions
Exploitability
Data exposure
Business impact
Root-cause classification

8.2 Secure Coding Corrections

Input validation
Parameterised operations
Context-aware output encoding
Explicit object binding
Centralised authorisation
Secure cryptographic APIs
Safe error handling
Least-privilege execution

8.3 Fix Validation

Original attack replay
Negative testing
Boundary testing
Alternate payload testing
Role-based regression testing
API regression testing

8.4 Remediation Evidence

Vulnerability description
Reproduction steps
Root cause
Corrective action
Retest results
Evidence capture

Disclaimer

This training outline is provided as a proposed instructional framework and may be refined, reordered, expanded or otherwise amended by the trainer to accommodate participant experience, technical constraints, organisational priorities, lab progress and emerging industry practices. Such adjustments may be made at the trainer’s professional discretion without prior notice, provided that the overall learning objectives and intended practical character of the programme are preserved.

Practical, connected learning

My wider training approach brings hands-on implementation and systems thinking together, connecting technology with real operational needs.

Secure Coding Attack Lab