Zalewski — The Tangled Web: A Guide to Securing Modern Web Applications
Main reference of the module (No Starch Press, 2011). Deep dive into browser security mechanisms and Web application vulnerabilities.
Web & Mobile Application Security
Master 2
Personal course page for the Web & Mobile Application Security module — Master 2 CS (Computer Security), University of Skikda. This page provides centralized access to lectures, labs, pedagogical resources, and module information.
Course progress
- This page follows the course as it is taught: new chapters and labs are added once they have been covered in class.
- Almost all course files have been revised. Download the latest versions, even if you already have earlier ones.
Official Syllabus
Track — Computer Security (UEF322)
Official syllabus — Web & Mobile Application Security
The Web & Mobile Application Security module, part of the Master 2 CS (Computer Security) program at the University of Skikda, is available on www.al-moualime.com. It covers Web and mobile application security: browser security model, OWASP Top 10, injection, XSS/CSRF, HTTPS/TLS, Content Security Policy, session & authentication security, XML/Web services security, and mobile application security. Semester 3, 4 credits, coefficient 3. Prerequisite: Network security and vulnerability analysis. Assessment: Continuous assessment and exam.
Resources
Mavoungou et al. — Survey on Threats and Attacks on Mobile Networks
IEEE Access, 2016. Complementary reference for the mobile security chapter.
Papageorgiou et al. — Security and Privacy Analysis of Mobile Health Applications
IEEE Access, 2018. Case study on mobile application data protection.
Oltrogge et al. — The Rise of the Citizen Developer
IEEE S&P, 2018. Complementary reference for the module.
Software
Nmap / Zenmap — Port and service scanner
Discovers open ports, running services and their versions on an authorized target; Zenmap is its graphical interface.
whois — Domain registry lookup
Queries domain registries: owner organization, registrar, creation and expiry dates, name servers (passive).
dig / nslookup — DNS queries
Resolve a name to its addresses (A, AAAA) and list its name servers (NS) and other DNS records.
curl — HTTP requests from the command line
Sends HTTP requests by hand and shows the response headers, e.g. to read a Web server banner.
theHarvester — OSINT gathering
Collects public addresses and subdomains associated with a domain from search engines and certificate logs (passive).
Browser developer tools — Console and Network tabs
Built into Chrome, Firefox and Edge: observe blocked requests, CORS errors and HTTP headers exchanged between two origins.
Python 3 / Flask — Local test servers
The built-in http.server module serves two sites on two ports; a short Flask script adds the CORS header.
Lectures
Introduction
General introduction to the Web & Mobile Application Security module: objectives, the attacker/defender mindset, the e-commerce scenario running through the course, and organization of lectures/labs.
Chapter 1 — Vulnerabilities and Attack Methods
Hacker types, red/blue/purple teams; intrusion phases, zero-day flaws, malware, social engineering.
Chapter 2 — Web Security Model
The browser as an operating system; permissions and secure contexts; the Same-Origin Policy and its limits; cross-origin communication with postMessage and CORS.
Appendix 1 — Understanding the Web to Understand Its Flaws
The mechanisms behind the chapters, from the local network to the browser (IP, ARP, NAT, BGP, TCP, UDP, DNS, HTTP, TLS, cookies, HTML, Same-Origin Policy): for each one, how it works, its design weakness, the attack and the defense, with exercises. After M. Zalewski, The Tangled Web.
Labs
⚠️ Responsibility & legal framework
The tools used in these labs (Nmap, theHarvester, curl…) are the same ones attackers use. Only use them on the targets named in each lab (for example scanme.nmap.org, made available by the Nmap authors for practice) or on your own machines. Scanning or testing a system without its owner’s written authorization may be illegal, in Algeria as elsewhere, even without malicious intent.
Each student is solely responsible for the use they make of these tools and techniques. Any use outside the authorized scope of the labs is their sole responsibility, both civil and criminal; the teacher and the University of Skikda accept no liability for any misuse or illegal use.
Lab 1 — Information Gathering and Port Scanning
Mapping a target application’s attack surface and entry points.
Lab 2 — Same-Origin Policy & CORS
Hands-on exploration of browser origin isolation and cross-origin resource sharing.