Attack surface and untrusted input
Threat modeling with STRIDE
Drawing trust boundaries
© 2026 Dometrain. All rights reserved.
Learn to spot the common attacks on web applications and apply their standard fixes through quizzes, system diagrams and Linux terminal exercises.
Most security holes in web applications come from a short list of mistakes: user input pasted into a query, a page that renders text as markup, a record loaded without checking who owns it, a secret left in source code. Engineers who were never shown how these attacks work keep shipping them, and code review rarely catches a bug that nobody on the team recognizes.
Application Security for Beginners teaches you to recognize each common attack and name its standard fix. Quiz lessons explain how each attack works, many with a picture of the request or data flow, and use short C# and JavaScript snippets. Diagram lessons have you design systems with trust boundaries, read-only database access, an isolated URL fetcher and a safe upload path. Terminal lessons run on a Debian Linux machine in your browser, where you fix a shell script so hostile file names stay single arguments, lock down a service account, protect and rotate secrets, install SSH keys and find a password-guessing attack in a log.
The course starts with threat modeling and STRIDE, then moves through injection, cross-site scripting, cross-site request forgery and CORS, password storage, sessions and JSON Web Tokens, access control, hashing, encryption and TLS, the software supply chain, misconfiguration, server-side request forgery and security logging, covering all ten categories of the OWASP Top 10:2025. It suits developers who know HTTP, basic SQL and the Linux shell and want to stop writing the bugs attackers look for first.
