Hey, and welcome to the course on exploiting and
security vulnerabilities in Java applications.
This is the fourth and last course into
secure programming specialization offered by UC Davis.
My name is [inaudible] Bhai.
My love for security started
when I was ten or 11 years old.
Before I moved to the United States I was living in Iran.
Back then, our inner was heavily censored.
But I wanted to play a game
on a server which was blocked.
As a result, my friends and I had to
learn about proxies to get out the censorship.
That's where my love for security began.
Outsmarting smart people to find
flaws where they have mistake.
For my undergraduate work,
I received the scholarship called
Scholarship for Service, SFS,
which was designed to bring folks with a background in
computer science or computer engineering with
an emphasis on security to the governments.
The program was designed and monitored by
the Department of Homeland Security
and the National Science Foundation.
Through my computer science curriculum
along with SFS work,
I was able to hone my skills as
a developer with an emphasis on security.
I began my professional career as
a software developer working on
embedded and distributed systems.
Over the last few years I have transitioned from
my primarily development role
to a software security architect.
I have to admit, I don't write as much code as I used to,
but I do miss it, and I try to say
active with my own projects in office.
Over the next several weeks,
your course learning objectives will be to learn,
to use tools and techniques of an attacker.
You will detect and fix
injection attacks in a large Java application.
You will be able to detect and fix
problems related to broken authentication,
find and fix problems related to
cross site scripting attacks and
even run some code on a compromised server.
In the first module, we'll focus
our attention on cross site scripting.
After module 1, you'll be able to find and
fix issues
related to cross site scripting vulnerabilities.
In the second module, we'll cover issues related to
interpreting user input that lead into injection attacks.
After module 2, you'll be able to detect
and fix injection attacks on a large code base.
In the third module, we'll turn
our attention into authentication weaknesses.
After that, you'll be able to better understand
the pitfalls with regards
to authentication and authorization.
In the final module,
we'll wrap up by fixing some vulnerable components.
If you've been paying attention to
the news you may have heard about
the Equifax breach which was
a result of a vulnerable component.
At the conclusion of module 4,
you will compile activities you've been doing
throughout the course into your final project.
The entire course is sequenced to
help you complete the final project.
Patching vulnerabilities in WebGoat.
WebGoat is deliberately insecure web application.
You will go through a process I
layouts to exploit WebGoat,
in order to understand vulnerabilities,
find and fix the code,
and then re-verify the fix
by attempting to re-explore the same vulnerability.
Our deliberately vulnerable application, WebGoat,
might include some design patterns and
architectures that might seem overly complicated.
That's because it's designed to
house the lessons themselves,
and the vulnerabilities are not
central to the back end architecture.
It's okay, I will do my best to make sure that
we don't get to lost in the scaffolding.
The WebGoat has to enable this modular lesson plans.
Each module will teach you the essentials you will
need to know and to be
prepared to complete your final projects.
After I introduced each topic,
you'll get a chance to try,
then I'll show you my approach.
At the end of each module,
you will complete a peer review graded lab activity.
The lab activity simply demonstrating
your approach to the activities you get a chance to do.
Remember, you can always review any lessons or
resources that address areas where you need a refresher.
You also have the discussion areas to look to.
Remember, software security is not difficult.
If you feel overwhelmed just try,
try, try again, and we'll get through it together.
We have a lot to cover, So let's dive in.