Official space for the Web & Mobile Application Security (SAWM) module — Master 2 SI, University of Skikda. This page provides centralized access to lectures, labs, pedagogical resources, and module information.
The Web & Mobile Application Security (SAWM) module, part of the Master 2 SI (IT Security) program at the University of Skikda, is available on www.al-moualime.com. It covers Web and mobile application security: browser security model, OWASP Top 10, injection, XSS/CSRF, HTTPS/TLS, Content Security Policy, session & authentication security, XML/Web services security, and mobile application security. Semester 3, 4 credits, coefficient 3. Assessment: Continuous assessment and exam.
Main reference of the module (No Starch Press, 2011). Deep dive into browser security mechanisms and Web application vulnerabilities.
IEEE Access, 2016. Complementary reference for the mobile security chapter.
IEEE Access, 2018. Case study on mobile application data protection.
IEEE S&P, 2018. Complementary reference for the module.
Web-side tools
Standard tools of the profession for intercepting, scanning, and testing Web traffic for vulnerabilities.
Open-source tool that automates the detection and exploitation of SQL injection flaws.
Deliberately vulnerable Web applications used to practice injection, XSS, and CSRF exploitation in a legal, controlled environment.
Mobile-side tools
Used to build and run Android test applications for the mobile security labs.
Automated static and dynamic analysis of mobile applications.
Dynamic instrumentation toolkit used to inspect and manipulate mobile apps at runtime.
Used to inspect Web/mobile network traffic and detect unencrypted communications.
General introduction to the Web & Mobile Application Security module: objectives, the attacker/defender mindset, the e-commerce scenario running through the course, and organization of lectures/labs.
Hacker types, red/blue/purple teams, intrusion phases, zero-day flaws, malware, social engineering.
The browser as an operating system: permissions, isolation, and the Same-Origin Policy.
OWASP Top 10, injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF); Web application protection techniques.
SSL/TLS refresher, hardening, certificates.
Web workers, CSP, and iframe sandbox isolation.
Site authentication, cookies, and session integrity.
XXE, XML bombs, AJAX and its associated attacks.
Mobile technologies, mobile security model, encryption, network threats, and privacy.
Full course handbook (all chapters)
EN
FR
Single-file compilation of the introduction and all 8 chapters.
Mapping a target application's attack surface and entry points.
Hands-on exploration of browser origin isolation and cross-origin resource sharing.
SQL injection and stored XSS on OWASP Juice Shop, with Burp/ZAP, then the matching fixes.
Certificate inspection with openssl, automated audit with testssl.sh, HSTS and mixed content.
Neutralizing a stored XSS with a Content Security Policy, report-only mode and frame-ancestors.