Lesson 6.6: Capstone: assessing and hardening the shop
The final mission of Web Security 101. Before the busiest sales week of the year, Northwind asks for a security assessment of the shop, with written authorisation, a scope and a time window. You work like a professional: read the authorisation, test only what's in scope, check headers and exposed files, test new API endpoints for injection and broken access control, fix the code and configuration, test and reload, verify every fix from outside, and write a short report graded by severity that you seal with a hash. Every step uses something from this course.
25 min
You will learn to
- Work within a written authorisation and scope
- Test headers, exposed files, injection and access control
- Fix code and configuration and apply them safely
- Verify fixes from outside
- Write and seal a severity-graded report
Key terms
- Security assessment
- An authorised review of a system's security that finds and grades weaknesses.
- Scope
- Exactly which systems, addresses and techniques the authorisation covers.
- Severity
- How serious a finding is, from impact and likelihood: critical, high, medium, low, informational.
- Regression
- A problem that was fixed and comes back, often through a new deployment.
← Packet analysis: finding what a device is really doing · All lessons · Permission, scope and rules of engagement →