In this course, we will discuss buffer overflows and integer over- and underflow vulnerabilities, their exploitation and mitigation. Our first module will focus on buffer overflow vulnerabilities, which are some of the simplest vulnerabilities that can exist in an application. This course discusses how poor memory management can leave an application open to attack, how the vulnerability can be exploited and potential mitigations to reduce the probability and impact of vulnerable code. Our second module focuses on Integer overflow and underflow vulnerabilities, which are caused by misuse of the various types of variables available in most programming languages. Understanding how to identify these vulnerabilities and how they can be exploited can prevent an attacker from bypassing checks or triggering other vulnerabilities (like buffer overflows).

This course will provide a background in several coding vulnerabilities: race conditions, format strings, and command injections. The first module discusses how the advent of parallel processing has made computers more efficient but also created new classes of vulnerabilities. We introduce the theory and practice of race condition vulnerabilities by describing what makes a code vulnerable, how it can be exploited and ways to mitigate the vulnerability. The second module introduces format string vulnerabilities, which use a deceptively simple aspect of programming: print statements. By exploiting format string vulnerabilities, an attacker can read from or write to arbitrary memory within a program. This module shows how to identify format string vulnerabilities and how to write code that is not vulnerable to attack. The last module in the course introduces command injection vulnerabilities, which take advantage of the fact that instructions and data are often mixed within programs. We demonstrate how command injection vulnerabilities can be exploited by an attacker, what to look out for and how to write code that is immune to this type of attack.

In this course, we will cover several secure coding vulnerabilities. In our first module, we cover SQL injection vulnerabilities, which are some of the most well-known and common vulnerabilities in existence. We describe what they are, how they work, how they can be exploited and steps that can be taken to fix them. A case study featuring Starbucks demonstrates how a small mistake can have big consequences. In module two, we move focus on cross-site scripting (XSS) vulnerabilities. XXS vulnerabilities are commonly underrated despite being the most common source of bug bounty payouts. This course describes the different types of XSS vulnerabilities, how to identify and mitigate them, and how they can be exploited to create big-name breaches like the ones pulled off by the Magecart Group. In our final module of the course, we cover cross-site request forgery (CSRF) vulnerabilities , which can force a user to take undesired actions on their account. These vulnerabilities can be easy to identify but harder to fix, since some seemingly logical solutions simply don’t work. This course discusses how the vulnerability works and the best ways to develop resilient code.

Our last course in this specialization focuses on credential management, cryptography, and vulnerabilities caused by poor HTML and HTTP usage and error handling. In our first module we discuss how using passwords for authentication. This course demonstrates what to do and what not to do when managing user credentials, including case studies, samples of vulnerable code and suggestions for managing user credentials in a secure fashion.

Module two describes how cryptography is a very useful tool, yet it can also be very fragile. A small error in design or implementation can destroy any benefits of using encryption in an application. You'll learn some of the common errors that developers make when using cryptography and how to remediate them. In module three, we will demonstrate how in most scenarios, developing a “clever hack” to achieve some goal is applauded in programming. However, this isn’t the case when abusing HTTP or HTML to simplify some aspects of web design. This course demonstrates some of the numerous ways in which poor use of HTTP and HTML makes a web application vulnerable to attack. In our last module of the course, we explain how handling potential errors in code is essential to protecting against many of the attacks described in this learning path. However, developers need to maintain a careful balance between providing too much and too little information in error messages. This course describes how going too far in one direction or another can leave an application vulnerable to attack.