Ethical Hacking and Web Security Foundations

This is a hands-on, defence-first introduction to web application security. You work only inside a strictly isolated lab: an attacker workstation (`attacker01`) and one deliberately vulnerable teaching application (`target01`) on a private network with no route to the internet. Nothing you do here ever touches a real site, a third party, or a system you were not explicitly authorized to test. Every technique is taught for one reason: you cannot reliably defend what you do not understand. For each vulnerability class — SQL injection, cross-site scripting, broken authentication and session management, broken access control, and security misconfiguration — you will see how an attacker finds and exploits it, and then, in the same lesson, exactly how to fix it and how to spot it in logs. Finding, fixing, and detecting are treated as one skill, not three. You will use the standard teaching toolset — a browser and its developer tools, `curl`, `nmap` (against your lab target only), and open, well-documented techniques — and you will practise the professional habits that separate a security practitioner from an intruder: agreeing scope in writing, staying inside it, writing a clear vulnerability report, and disclosing responsibly. The course closes with an authorized assessment of the teaching app that mirrors real junior-analyst work. This course is a learning pathway toward defensive web-security work. It does not promise a job, a salary, or a vendor credential; on completion you earn an Ultiblob Certificate of Completion.