Application Fundamentals
A vendor-neutral path through HTTP, APIs, databases, authentication, the secure SDLC, the OWASP Top 10, the software supply chain and release practice. Every room ends with the control, the evidence and the audit question.
9
rooms
1545
total XP
8h
est. time
What you'll be able to do
- ›Explain HTTP, APIs, sessions and tokens precisely
- ›Threat model with STRIDE and map OWASP Top 10 findings to controls
- ›Assess dependency, SBOM and provenance practice
- ›Turn a pentest report into tracked, owned remediation
Rooms
How Applications Work
Trace a browser request, distinguish method guarantees, and test session and access-control claims against HTTP evidence.
APIs and Data Formats
Read API contracts, preserve complete evidence collections, and distinguish signed credentials from secret data.
Databases for Applications
Trace application data through keys, queries and transactions, then defend database access, recovery and audit evidence.
Authentication and Authorisation in Apps
Trace identity from password verification to delegated tokens, then enforce access on every object request.
The Secure SDLC
Turn application risks into testable requirements, threat models, complementary tests and evidence-backed release decisions.
The OWASP Top 10 in Depth
Trace all ten 2021 application risk categories to their mechanisms, preventive controls, and defensible closure evidence.
Software Supply Chain
Trace dependency graphs, verify release identity and build provenance, and turn vulnerability findings into time-bound decisions.
Release and Runtime
Promote tested releases through isolated environments, enforce independent approval, and operate with reversible changes, protected secrets and actionable telemetry.
Application Fundamentals Capstone
Convert penetration-test evidence into business-ranked risks, testable controls, accountable deadlines and verified remediation.