OWASP-minded checks for web apps

18 min · Module 19

Think in risks: injection, XSS, CSRF, sensitive data exposure, misconfig. For HelpDesk, try script tags in subject/description and see encoding; ensure CSRF on state-changing POSTs.

Never attack systems without authorization—this Lab is your safe range.

Example / notes

# Manual/API idea: POST subject "<script>alert(1)</script>"
# UI should show encoded text, not execute script

Practice in Lab: /lab/app/tickets/new/

← Auth, sessions, and authorization

Modules in this track

15. QA Foundations — Strategy & Planning
- Writing a test strategy
- Test planning and estimation
16. Test Design Techniques
17. API & Contract Testing
- HTTP API testing fundamentals
- Contract and schema testing
18. Performance Testing Basics
- Performance concepts and SLOs
- Designing a minimal performance check
19. Security Testing Basics
- Auth, sessions, and authorization
- OWASP-minded checks for web apps
20. Accessibility Testing
- Accessible by design checks
- Automated a11y smoke
21. Mobile Testing
- Mobile web quality risks
- Native apps and device farms (overview)
22. CI/CD, Quality Gates & Environments
- Pipelines and quality gates
- Environments and progressive delivery
23. Test Data, Environments & Observability
- Test data management
- Observability for QA
24. Soft Skills — Stakeholders, Mentoring, Metrics
- Stakeholder communication
- Mentoring and quality metrics/OKRs
25. Career & Process — Agile, Compliance, Senior Bar