Secure Coding Attack Lab

Hands-On Application Security and PCI DSS Workshop - 2 Days

Modern applications depend on web interfaces, APIs, databases, authentication services, client-side code and cryptographic components. Weaknesses in these areas can expose sensitive data, enable unauthorised access and compromise transactions.

This two-day hands-on workshop covers key application attack categories relevant to PCI DSS Requirement 6. The labs use selected examples from .NET, Node.js, Java, Flutter, Golang and SAS where relevant. The focus is on common secure coding principles rather than separate language-specific deep dives.

Participants examine vulnerable applications, observe and reproduce selected attacks in a controlled environment, identify root causes, apply secure coding fixes and validate remediation through retesting.

Topics marked with an asterisk (*) indicate content directly relevant to PCI DSS v4.x Requirement 6 and associated secure software-development and application-security requirements.

Learning Outcomes

Participants will be able to:

Understand basic application-security concepts and terminology.
Understand HTTP requests, APIs, authentication, authorisation and trust boundaries.
Set up and use a controlled application-security testing environment.
Map web, API, mobile and data-processing attack surfaces.
Identify and reproduce common injection vulnerabilities.
Detect weaknesses in input handling, object binding and file processing.
Identify common business-logic and API abuse scenarios.
Recognise password, cryptographic and secret-management weaknesses.
Test XSS, CSRF and client-side security weaknesses.
Identify authentication, session and access-control vulnerabilities.
Test for privilege escalation, IDOR and BOLA.
Apply secure coding corrections using patterns relevant to .NET, Node.js, Java, Flutter, Golang and SAS.
Validate security remediation by replaying attacks and performing regression testing.
Understand PCI DSS v4.x Requirement 6 expectations relevant to software development.
Relate common application vulnerabilities to OWASP guidance.
Understand SAST, DAST and SCA within secure development workflows.
Understand dependency, supply-chain and secrets-management risks.
Understand secure SDLC and CI/CD security practices.
Understand appropriate use and governance of AI-assisted secure coding.

Prerequisites

Basic software-development or application-support experience
Familiarity with web applications is helpful but not essential
Basic understanding of APIs and database-backed applications
Ability to read code in at least one common programming language such as .NET, Node.js, Java, Flutter/Dart, Golang or SAS
Basic command-line skills
Administrator access to the supplied lab workstation or virtual machine
A laptop capable of running the designated lab environment
No previous penetration-testing experience required

Training Outline

Day 1

1. Application Security Foundations and Lab Setup *

1.1 Application Security Fundamentals

Application security overview
Vulnerabilities, threats, attacks and exploits
Attack vectors
Attack surfaces
Trust boundaries
Client-side vs server-side security
Secure coding principles
Remediation
Security validation
Regression testing

1.2 Web and API Fundamentals

Web applications
APIs
Frontend and backend components
HTTP requests and responses
HTTP methods
URLs and endpoints
Parameters
Headers
Cookies
Request bodies
JSON
Authentication tokens
Authentication vs authorisation

1.3 Lab Environment

Vulnerable application overview
Local application and database services
Test users and roles
Test data
Application reset and recovery
Overview of where .NET, Node.js, Java, Flutter, Golang and SAS commonly appear in enterprise application architectures

1.4 Security Testing Tools

Browser developer tools
Intercepting proxy
API client
Command-line request tools
Source-code editor
Application logs

1.5 Attack-Surface Mapping *

Web routes
API endpoints
HTTP methods
Parameters
Headers
Cookies
Request bodies
Authentication boundaries
Role and permission boundaries
Client-side trust boundaries
Mobile client-to-API boundaries relevant to Flutter
Backend service boundaries relevant to .NET, Node.js, Java and Golang
Data-processing boundaries relevant to SAS

1.6 Trainer Demonstration

Inspecting a normal application request
Identifying parameters, headers and authentication information
Tracing a request from client to backend
Modifying a controlled request
Observing application behaviour
Identifying potential attack surfaces

2. Injection Attacks and Secure Input Handling *

2.1 Injection Fundamentals

What injection vulnerabilities are
Data vs instructions
Untrusted input
Interpreters and query languages
Unsafe dynamic construction
Common injection attack categories

2.2 SQL Injection *

Basic Explanation

Application-to-database interaction
SQL queries
Dynamic queries
Unsafe string construction

Attack Demonstration

Query parameter manipulation
Form-input manipulation
Authentication query weaknesses
Unsafe dynamic queries
Observing vulnerable application behaviour
Reviewing vulnerable source code

Prevention

Parameterised queries
Prepared statements
Input validation
Least-privilege database access
Safe error handling

Remediation Validation

Applying parameterised query remediation
Replaying the original security test
Negative testing
Boundary testing
Regression testing
Examples relevant to .NET, Node.js, Java, Golang and SAS

2.3 Command Injection *

Basic Explanation

Operating-system command execution
Commands and arguments
Shell metacharacters
Risks of constructing commands from user input

Attack Demonstration

Unsafe operating-system command construction
Input manipulation
Argument manipulation
Identifying the vulnerable code

Prevention

Avoiding unnecessary shell execution
Safe process execution
Argument separation
Command allow-listing
Input validation
Least-privilege execution

Remediation Validation

Replaying the original test
Confirming malicious input is rejected
Confirming legitimate functionality remains operational
Examples relevant to .NET, Node.js, Java and Golang

2.4 Other Injection Categories

LDAP injection overview
XPath injection overview
Template injection overview
Unsafe query construction
Input escaping
Safe query handling
Common prevention principles

2.5 Secure Input Handling *

Input validation
Type validation
Length validation
Range validation
Allow-listing
Parameterised operations
Negative testing
Boundary testing
Regression testing

3. Data Handling, Object Binding and File Processing *

3.1 Unsafe Input and Data Handling

Basic Explanation

Expected and unexpected input
Data types
Input boundaries
Server-side validation
Error handling

Attack Demonstration

Missing validation
Malformed input
Boundary-value manipulation
Invalid data types
Extreme values

Prevention

Server-side validation
Schema validation
Type checking
Range and length restrictions
Secure error handling

Remediation Validation

Negative testing
Boundary testing
Legitimate-input regression testing

3.2 Mass Assignment and Object Binding *

Basic Explanation

Automatic request-to-object mapping
Hidden properties
Privileged properties
Over-posting

Attack Demonstration

Inspecting a legitimate request
Adding unexpected object properties
Attempting to modify privileged properties
Reviewing vulnerable object-binding code

Prevention

Data-transfer objects
Explicit property mapping
Property allow-listing
Property-level authorisation

Remediation Validation

Replaying manipulated requests
Confirming unauthorised fields are rejected
Confirming legitimate updates remain functional
Examples relevant to .NET, Node.js, Java and Golang

3.3 Insecure Deserialization *

Serialization and deserialization fundamentals
Untrusted serialized input
Unsafe object reconstruction
Polymorphic object handling
Trusted-type allow-listing
Schema-restricted formats
Secure replacement patterns
Trainer demonstration where appropriate

3.4 File and Path Security *

Basic Explanation

File uploads
Filenames
File extensions
Content types
Application storage
Filesystem paths

Attack Demonstration

File-name manipulation
Path traversal
Content-type trust
File-size manipulation
Unsafe storage behaviour

Prevention

Server-side file validation
Safe filename generation
Content validation
File-size restrictions
Temporary-file handling
Secure storage boundaries
Safe path handling

Remediation Validation

Replaying malicious file or path requests
Confirming unauthorised access is blocked
Testing legitimate file operations

4. Business Logic and API Abuse *

4.1 Business-Process Mapping

Basic Explanation

Business rules
Workflows
Transactions
Application state
Trust assumptions
Server-side enforcement
Intended transaction sequence
Required approvals
State transitions
Server-side enforcement points

4.2 Workflow Manipulation *

Attack Demonstration

Step skipping
Out-of-order operations
Request replay
Duplicate submissions
Partial-completion abuse

Prevention

Server-side workflow validation
State-transition enforcement
Replay protection
Duplicate-request protection

Remediation Validation

Repeating manipulated workflows
Confirming invalid state transitions are rejected
Confirming legitimate workflows remain functional

4.3 Parameter and Value Manipulation *

Attack Demonstration

Price manipulation
Quantity manipulation
Discount manipulation
Negative values
Extreme values
Hidden-field manipulation

Prevention

Server-side value calculation
Server-side business-rule enforcement
Input constraints
Trusted data sources

Remediation Validation

Replaying manipulated requests
Boundary testing
Confirming server-calculated values
Legitimate transaction regression testing

4.4 API and Mobile Client Trust

API trust boundaries
Excessive trust in client-supplied values
Server-side validation requirements
Flutter mobile client trust boundaries
Backend enforcement requirements

Day 2

5. Authentication, Sessions and Access-Control Attacks *

5.1 Identification, Authentication and Authorisation

Basic Explanation

User identification
Authentication
Authorisation
Roles
Permissions
Resource ownership
Policy decision points
Policy enforcement points

5.2 Authentication Weaknesses *

Default credentials
Username enumeration
Password-reset weaknesses
Multi-factor authentication weaknesses
Account-lockout weaknesses
Missing rate limiting
Secure authentication controls
Trainer demonstrations where appropriate

5.3 Session and Token Weaknesses *

Sessions and cookies
Authentication tokens
Session fixation
Session-token predictability
Token reuse
Missing logout invalidation
Missing session rotation
Weak cookie attributes
Improper token validation
Secure session-management principles

5.4 Horizontal Privilege Escalation *

Basic Explanation

User-to-user access
Resource ownership
Tenant boundaries

Attack Demonstration

Identifier substitution
Cross-account data access
Cross-account actions
Tenant-isolation testing

Prevention

Resource ownership checks
Per-object authorisation
Server-side access controls
Tenant isolation

Remediation Validation

Testing as the resource owner
Testing as another user
Testing across tenants
Regression testing

5.5 Vertical Privilege Escalation *

Basic Explanation

User and administrator roles
Restricted functionality
Role-based permissions

Attack Demonstration

Restricted function invocation
Role-parameter manipulation
Privileged route access

Prevention

Server-side permission enforcement
Centralised authorisation
Deny-by-default access controls

Remediation Validation

Standard-user testing
Administrator testing
Unauthorised-role testing
Privilege regression testing

5.6 IDOR and BOLA *

Basic Explanation

Object identifiers
Resource ownership
Object-level authorisation
Authentication vs object authorisation

Attack Demonstration

Accessing a legitimate resource
Modifying an object identifier
Testing unauthorised read access
Testing unauthorised update access
Testing unauthorised delete access

Prevention

Per-object authorisation
Resource ownership checks
Tenant boundaries
Centralised authorisation policies

Remediation Validation

Owner access testing
Other-user access testing
Cross-tenant access testing
Privileged-role testing

5.7 Access-Control Remediation *

Centralised authorisation
Deny-by-default policies
Consistent middleware enforcement
Role-permission matrices
Negative authorisation testing
Privilege regression testing

6. XSS, CSRF and Client-Side Security *

6.1 Cross-Site Scripting *

Basic Explanation

HTML and JavaScript
Browser execution
Trusted and untrusted content
Output contexts
Reflected XSS
Stored XSS
DOM-based XSS

Attack Demonstration

Identifying vulnerable input
Unsafe output rendering
Demonstrating unintended browser behaviour in the controlled lab
Inspecting vulnerable rendering code

Prevention

Context-aware output encoding
HTML sanitisation
Safe DOM operations
Framework security controls
Content Security Policy

Remediation Validation

Replaying original security tests
Testing alternate input
Confirming legitimate content rendering

6.2 Cross-Site Request Forgery *

Basic Explanation

Cookie-based authentication
State-changing requests
Cross-origin requests

Attack Demonstration

State-changing request discovery
Forged request demonstration in the controlled environment

Prevention

Anti-CSRF tokens
SameSite cookie controls
Origin validation
Referer validation
Re-authentication for sensitive actions

Remediation Validation

Repeating the forged request
Confirming rejection
Confirming legitimate requests continue to work

6.3 Client-Side Security *

Local-storage exposure
Browser token storage
Source-map exposure
Client-side secret exposure
Flutter mobile local-storage and token-handling risks
Why client-side validation is insufficient
Server-side validation requirements

7. Secrets, Passwords and Cryptography Misuse *

7.1 Password Protection *

Basic Explanation

Password storage
Hashing
Encryption vs hashing
Salt
Work factors

Weaknesses

Plaintext password storage
Reversible password storage
Weak password hashes

Prevention

Password-hashing functions
Salt generation
Appropriate work-factor configuration
Secure password libraries

Remediation Validation

Inspecting resulting password storage
Confirming authentication remains functional
Confirming insecure storage has been removed

7.2 Hard-Coded Credentials and Secrets *

Attack and Detection Demonstration

Embedded passwords
API keys in source code
Configuration-file secrets
Log and diagnostic leakage
Secret scanning

Prevention

Secure secret injection
Secret-management systems
Access controls
Secret rotation
Preventing secrets from entering logs and build artifacts

Remediation Validation

Rescanning source code
Inspecting configuration
Inspecting logs
Confirming secure application access to required secrets

7.3 Encryption in Transit *

TLS fundamentals
Certificate validation
Hostname verification
Trust-store handling
Insecure protocol fallback
Secure configuration principles
Trainer demonstration where appropriate

7.4 Token and Randomness Weaknesses *

Predictable tokens
Weak session identifiers
Improper signing
Missing integrity checks
Secure token generation
Secure randomness

7.5 Cryptographic Remediation *

Approved algorithms
Secure cryptographic libraries
Key separation
Secret rotation
Secure failure handling
Remediation verification

8. PCI DSS Secure Development and Modern Application Security *

8.1 PCI DSS v4.x Requirement 6 Overview *

Basic Explanation

What PCI DSS is
Purpose of PCI DSS
Why Requirement 6 matters to developers
Secure software-development expectations
Application vulnerability management
Secure coding
Security testing
Remediation
Documentation and evidence

8.3 OWASP Top 10 Mapping *

OWASP Top 10 overview
Broken Access Control
Cryptographic Failures
Injection
Insecure Design
Security Misconfiguration
Vulnerable and Outdated Components
Identification and Authentication Failures
Software and Data Integrity Failures
Security Logging and Monitoring Failures
SSRF awareness
Mapping workshop attack examples to OWASP categories
Relationship between OWASP guidance and PCI DSS

8.4 Secure Code Review *

Basic Explanation

Purpose of secure code review
Manual security review techniques
Identifying dangerous coding patterns
Input-handling review
Authentication and authorisation review
Cryptographic review
Secret-management review
Security-focused pull-request reviews
Documenting findings

Trainer Demonstration

Reviewing vulnerable code
Identifying the security weakness
Explaining the root cause
Applying a correction
Validating the correction

8.5 SAST, DAST and SCA *

Static Application Security Testing

Source-code analysis
Common findings
Strengths and limitations
False positives

Dynamic Application Security Testing

Testing a running application
Common findings
Strengths and limitations

Software Composition Analysis

Third-party libraries
Known vulnerabilities
Dependency analysis

Trainer Demonstration

Running a selected application-security tool
Reviewing a finding
Validating whether the finding is genuine
Identifying root cause
Applying remediation
Rescanning or retesting

8.6 Secrets Management in CI/CD *

Repository secrets
API keys
Database credentials
Pipeline credentials
Environment variables
Secret stores
Secure secret injection
Secret scanning
Access control
Secret rotation
Build-log exposure
Artifact exposure

8.7 Dependency and Supply-Chain Security *

Third-party dependency risks
Vulnerable packages
Transitive dependencies
Dependency scanning
Dependency version management
Package integrity
Trusted package sources
Software Bill of Materials concepts
Supply-chain attack awareness
Dependency remediation and patching

8.8 Secure SDLC and Change Management *

Security requirements
Secure design
Threat identification
Secure coding standards
Code review
Security testing
Security gates
Vulnerability remediation
Regression testing
Change review and approval
Release controls
Continuous security improvement

8.9 Security Integration with CI/CD *

Integrating SAST
Integrating SCA
Automated testing
DAST in test environments
Security gates
Severity thresholds
Vulnerability triage
Remediation and retesting

Development → Code Review → SAST/SCA → Build → Testing → DAST → Remediation → Approval → Deployment

8.10 AI-Assisted Secure Coding

AI coding assistants
AI-assisted code review
AI-assisted vulnerability identification
AI-assisted remediation
Security risks of AI-generated code
Incorrect or incomplete AI-generated fixes
Sensitive-code considerations
Secret and data leakage risks
Human review requirements
Governance and acceptable-use controls
Example workflow using Qoder or an equivalent AI coding assistant

Trainer Demonstration

Reviewing vulnerable code using an AI assistant
Reviewing AI-generated vulnerability analysis
Evaluating an AI-generated remediation suggestion
Human verification of the proposed correction
Replaying the security test
Accepting or rejecting the remediation based on validation

9. Secure Remediation and Retesting Workshop *

9.1 Vulnerability Triage

Reproduction reliability
Attack preconditions
Exploitability
Data exposure
Business impact
Root-cause classification
Prioritisation

9.2 Secure Coding Corrections

Input validation
Parameterised operations
Context-aware output encoding
Explicit object binding
Centralised authorisation
Secure cryptographic APIs
Safe error handling
Least-privilege execution

9.3 Fix Validation

Original attack replay
Negative testing
Boundary testing
Alternate input testing
Role-based regression testing
API regression testing
Functional regression testing

9.4 Remediation Documentation

Vulnerability description
Reproduction evidence
Root cause
Security correction
Retesting evidence
Regression-test results
Closure evidence

10. Final Attack, Remediation and Validation Exercise *

Participants apply the techniques covered during the workshop to a controlled application containing selected security weaknesses.

10.1 Attack-Surface Review

Identify application endpoints
Identify trust boundaries
Identify security-sensitive functionality
Identify potential attack points

10.2 Vulnerability Investigation

Participants investigate selected categories such as:

Injection
Object binding
Business-logic manipulation
XSS
IDOR/BOLA
Access-control weaknesses
Secret exposure

10.3 Root-Cause Analysis

Identify the vulnerable coding or design pattern
Explain why the vulnerability exists
Identify the appropriate secure coding control

10.4 Remediation

Apply or review the secure coding correction
Confirm expected application functionality

10.5 Security Validation

Replay the original security test
Perform negative testing
Perform boundary testing where relevant
Perform authorisation regression testing
Confirm legitimate functionality remains operational

10.6 Remediation Reporting

Finding
Attack evidence
Root cause
Prevention
Remediation
Validation result
Relevant PCI DSS relationship where applicable
Relevant OWASP category where applicable

Disclaimer

This training outline is provided as a proposed instructional framework and may be refined, reordered or adjusted by the trainer to accommodate participant experience, technical constraints, organisational priorities, laboratory progress and emerging industry practices.

The depth of individual demonstrations and exercises may vary to ensure the programme remains achievable within the two-day duration while preserving its overall learning objectives and practical character.

Practical, connected learning

My wider training approach brings hands-on implementation and systems thinking together, connecting technology with real operational needs.