Software and Web Application Security
136 resources created by 106 users
This Software and Web Application Security page on GoConqr gathers community-made quizzes, mind maps, flashcards and notes on secure development, threat modelling, SQL injection, cross-site scripting and web penetration testing. It's built for university students and professional candidates practising for exams such as CISSP and Security+, and for teachers after ready-made material. There are over 130 resources here, including more than 40 quizzes, 40 mind maps and 20 flashcard decks, with a few suited to school students. Pick a topic, try a quiz to find your gaps, then make your own revision sets.
Select topic
- Secure Software Development Lifecycle12
- Threat Modeling8
- Secure Coding and Input Validation9
- Application Security Testing7
- Application Security Controls and Defenses5
- Application Vulnerabilities and Attacks27
- SQL Injection and Cross-Site Scripting9
- Buffer Overflows and Memory Vulnerabilities6
- Authentication, Authorization and Session Security9
- Web Server and Browser Security8
- Web Encryption and TLS5
- Malware and Web-Based Malware7
Top Software and Web Application Security resources
-
182 questionsSecure Software Development Final The PRIMARY reason for incorporating security into the software development life cycle is to protect
-
45 questionsSecure Software Implementation/Coding An attack that uses the user interface to manipulate data structures behind the application is called:
-
200 questionsSec+ Which of the following is used to encrypt web application data?
-
185 questionsAdvanced Digital Security Practice Quiz The gets() C function is never safe because
-
55 cardsSoftware and Web Security Challenge of many types of data and ways data can be input ito a comptersystem or application
-
82 questionsinfo security final The browser is not a safe programming environment Attackers can:
-
11 questionsQuestões - Security in web applications Which of the following correctly defines data integrity? (Select one)
-
20 questionsDeane 21-40 Which of the following threat types involves the sending of invalid and manipulated requests through a user...
Quizzes
See all 48 quizzes-
182 questionsSecure Software Development Final The PRIMARY reason for incorporating security into the software development life cycle is to protect
-
45 questionsSecure Software Implementation/Coding An attack that uses the user interface to manipulate data structures behind the application is called:
-
200 questionsSec+ Which of the following is used to encrypt web application data?
-
185 questionsAdvanced Digital Security Practice Quiz The gets() C function is never safe because
-
82 questionsinfo security final The browser is not a safe programming environment Attackers can:
-
11 questionsQuestões - Security in web applications Which of the following correctly defines data integrity? (Select one)
-
20 questionsDeane 21-40 Which of the following threat types involves the sending of invalid and manipulated requests through a user...
-
89 questions4337 Final Practice Quiz The RAD compiler solution can prevent against code injections.
Mind maps
See all 48 mind mapsFlashcards
See all 27 flashcards-
55 cardsSoftware and Web Security Challenge of many types of data and ways data can be input ito a comptersystem or application
-
76 cardsInformation Security Deep Dive What is Broken Access Control?
-
41 cardsSoftware Security Concepts 2
-
38 cardsW8: Security and Risk What are the six security principles?
-
46 cards1.5 Application and Security Controls What are 3 web application security design considerations?
-
33 cardsCompTIA Security + 1.3 Application Attacks
-
24 cardsSecurity+ Application Attacks
-
19 cardsSecurity What is SQL injection?
Flowcharts
Notes
See all 10 notes-
Web Application Attacks 13.1 - Essential Iceweasel Add-ons 13.2 - Cross Site Scripting (XSS) 13.2.1 - Browser Redirection and IFRAME Injection 13.2.2 - Stealing Cookies and Session Information 13.2.3 - Exercises 13.3 - File Inclusion Vulnera...
-
Software Security Notes Security Requirements Protect data (encrypt) Trust nothing and no one (validate and check authorization) Identify, authenticate and authorize Escape all input Manage secrets (protected stores) MFA and care with passwo...
-
Developing Secure Software - created from Mind Map Stages of Security Security should be factored into every stage of the software development life cycle Design Phase: a threat model should be drawn up, this will then be refered to and followed throughout the rest of ...
-
Internet Security Threat Model Different from other threat models Attacker isn't in control of the network Attacker hasn't got access to the target's OS Instead attacker sees messages addressed to themselves or others Sees data obtaine...
-
Web Application Security Injection : What ? Untrusted user input is interpreted by server and executed What is impact ? Data modified and stolen. How to prevent it ? - Reject invalid/untrusted input - Use latest frameworks - Hire penet...
-
Seguridad de Software Historia Redes conectadas con usuarios simultáneos 1970: Recolección de información en red. Hackers: intercambio de código Antivirus Prevención de ataques, a pesar de esto sigue habiendo ataques debido a poca document...
-
Secure Software Development and Testing - created from Mind Map Security Testing Security Principles Secure Software Development
-
Untitled Cross Site Scripting (XSS) Cross Site Request Forgery (CSRF) Clickjacking (UI Redressing Attack) Local File Inclusion (LFI) Subdomain Takeover Denial of Service (DOS) Authentication Bypass SQL injection ...
Slides
Topics in Software and Web Application Security
More Cybersecurity topics
About Software and Web Application Security
GoConqr OriginalWhat the page covers
The resources fall into two linked themes: building software securely and defending web applications. On the development side, the quiz Secure Software Development Final asks why security belongs in the software development life cycle. The mind maps SDL and SDL_1 walk through security requirements, threat modelling, data flow diagrams and STRIDE. On the web side, the notes Web Application Attacks cover cross-site scripting, cookie and session theft, and browser redirection.
Where to start
- Open the mind maps Computer Security U9 - Software Security and Computer Security U10 - Web Security for the big picture: why holes appear, and how HTTP being stateless creates risk.
- Read the notes Developing Secure Software - created from Mind Map to see security placed in each stage of the life cycle.
- Move to the Security flashcards, which ask what SQL injection and XSS are and how to guard against them.
- Finish with the Secure Software Implementation/Coding quiz.
Using quizzes and maps together
Work through a map first, then take a quiz on the same topic. Note every question you miss and go back to the matching branch of the map. The Web Penetration Testing mind map, which lists the OWASP 10, a method and its tools, pairs well with the web-hacking practice quizzes on servers, applications and SQL injection.
For exam candidates
Several flashcard decks are aimed at Security+ topics, such as application attacks and software development. The resources also mention CISSP, so candidates can use them to check recall of key terms. Teachers can pick a map or quiz to set as a starter or a revision task.
Where this unit sits
This unit belongs to the strand System, Application and Data Security in the Cybersecurity subject. Choose one resource today, try it, and then build a map or deck of your own to fill any gaps you find.
Frequently asked questions
Which resource should I open first?
Start with the mind maps Computer Security U9 - Software Security and Computer Security U10 - Web Security. They give you the overall picture of software weaknesses and web risks. After that, try the Secure Software Development Final quiz to see which ideas you need to revisit.
What do the mind maps cover?
They cover the secure development process, including SDL steps, threat modelling and STRIDE, plus web topics such as SQL injection, web penetration testing and OWASP. Some maps look at specific settings, such as the one on building secure web apps, so you can pick the angle that suits you.
Are the resources free to use?
Yes. Every resource listed here is free to open, study and take, with no account needed. They were made by GoConqr users, not by GoConqr itself. A free account also saves your quiz scores and lets you make your own quizzes, mind maps, flashcards and notes.
Which exams do these resources suit?
The listed resources mention CISSP and Security+. Look for flashcard decks on Security+ application attacks and software development, and quizzes on software development security. Most material is aimed at university students and professional candidates, so it suits that level of study.
Is there anything for practising SQL injection?
Yes. The Security flashcards ask what SQL injection is and how to protect a website from it. There is also a SQL Injection mind map and a quiz called Chapter 14: SQL Injection 1-10. Use the cards to learn the ideas, then the quiz to test them.
What if I can't find the topic I need?
Try a nearby resource first, such as a mind map on web security or a flashcard deck on application attacks. If the topic is still missing, you can make your own quiz, mind map, flashcards or notes and use them for revision.