Hack a Website: a defensive web security course

Hack a Website is an introductory ethical hacking course focused on web security. It teaches how common website weaknesses work so that you can build and review sites that are not vulnerable to them. Across 26 short sections it covers the law and ethics of security testing, why a server must never trust what a browser sends, the OWASP Top 10, and the main classes of web weakness, each paired with the defence developers use against it.

All of the course's exercises run on simulated pages built for the purpose. The course is clear from its second section that testing a real system without permission is a crime.

What the course covers

The law and ethics come first

Accessing a computer system without permission is a criminal offence. In the UK it falls under the Computer Misuse Act 1990, and in the US under the Computer Fraud and Abuse Act; most countries have similar laws. Curiosity is not a defence. Ethical hackers test only systems they own, or systems whose owner has given clear, written permission, and they stay inside the agreed scope.

Decide which kinds of testing stay on the right side of the law, then press Mark to check your answers in the course:

How the main weaknesses work, and how they are fixed

Never trust the browser

Everything a browser sends, including form fields, hidden values, cookies and headers, is under the control of whoever is using it. So the server has to check every request itself. This one idea underlies most of the course.

Injection

Injection happens when a program mixes untrusted text into a command, such as a database query, so the text can change what the command means. The standard defence is to keep data and commands apart, for example with parameterised queries, where values are passed separately and can never be read as part of the command.

Cross-site scripting

Cross-site scripting happens when a site places a visitor's text into a page in a way that lets the browser treat it as code. The defences are output encoding, which makes text display as text, and a Content Security Policy, a header that tells the browser which scripts the site allows.

Cross-site request forgery

Browsers send a site's cookies with requests to it, even when another site started the request. Without protection, that lets another site trigger actions as a logged-in user. SameSite cookie settings and anti-forgery tokens stop it.

Accounts, access and configuration

Passwords should be stored only as slow, salted hashes, never as typed. Rate limits and multi-factor authentication make guessing impractical. Access control checks, on every request, that the logged-in user is allowed to do this action to this particular item. HTTPS, security headers and keeping secret keys out of code repositories close off further routes.

Who this course is for

• Web developers who want to write code that holds up against the common weaknesses.
• Computing students studying cyber security threats and how they are prevented.
• Anyone considering a career in cyber security, who wants an honest, legal starting point.

What you need to know first

The course page lists HTML, CSS & JavaScript and APIs first. You need to know how a web page talks to a server with requests and responses. Our TLS and SSL guide covers HTTPS in more depth.

How long it takes

There are 26 sections and most take a few minutes. Learners without a plan can open two sections of a course a day, in order, so the whole course takes 13 days. A plan removes the daily limit and lets you go straight to any topic.

Read next

Computer Science · CoursesHardware security course: threats to devices and defencesA hardware security course in 25 short sections: side channels, faults, debug ports, secure boot, supply chains and tamper resistance.