powstik
Prove
LiveProof-of-Work · Oct–Nov: every verified proof counts. 35 days leftAll outcomes
Skills

Find Security Holes in Web Apps

6 weeks · 2 milestones

Identifying Security Vulnerabilities (PortSwigger Web Security Academy), then one project of your own. Part of the Varsity Curriculum: Computer Science.

Milestone map

Milestone map

2 milestones

Do the course work in public

2–4 weeks (4 hrs/week)

Take Identifying Security Vulnerabilities for free and do Web Security Academy labs (SQL injection, XSS, access control), each with a write-up. Keep everything in one public repo or notebook as you go. OSSU lists a Coursera course. We use the free Web Security Academy.

Proof required

Link your public repo or notebook with Web Security Academy labs (SQL injection, XSS, access control), each with a write-up, and a screenshot or log showing the self-check passed.

What gets checked

  • Labs are marked solved on your account.
  • Write-ups explain why the attack worked.
  • Each names the fix.

Common mistakes

  • Copying posted answers: verifiers read the history.
  • Skipping the self-check, then asking for review too early.

Powstik Guide

A public repo or notebook with Web Security Academy labs (SQL injection, XSS, access control), each with a write-up.

Steps

  1. Make a public repo or notebook first.
  2. Do one unit at a time and commit after each.
  3. Run the self-check: Solve the apprentice labs; the site marks each one solved.
  4. Write a short README: what is here and how to run it.
  5. Ask three people who know the topic to check it.

Template

README
Course: Identifying Security Vulnerabilities (PortSwigger Web Security Academy)
What is here:
How to run it:
Self-check result:
What was hardest:

What gets sent back

  • No history, just one big upload.
  • Self-check not shown.
  • Code that does not run from the README.

Resources

Foundationstart here

Depthgo deeper

What a verifier looks for

  • Labs are marked solved on your account.
  • Write-ups explain why the attack worked.
  • Each names the fix.
  • Ask one question about a choice in the code; the answer should be clear.

You'll sign in first, then come straight back here.

Check one of your web apps

1–3 weeks (5–8 hrs/week)

Use what you learned. Make a test of your own web app for the bugs you learned, with findings and fixes. Keep it small enough to finish in about two weeks.

Proof required

Link a test of your own web app for the bugs you learned, with findings and fixes, with a README that says how to run or read it.

What gets checked

  • Only your own app was tested.
  • Findings have proof.
  • Fixes are in the code.

Common mistakes

  • A project too big to finish.
  • A demo that only works on your machine.

Powstik Guide

A test of your own web app for the bugs you learned, with findings and fixes.

Steps

  1. Write one line: what it does and for whom.
  2. Build the smallest version that works.
  3. Test it on someone else's machine or with someone else reading it.
  4. Write the README.
  5. Ask three people to check it.

Template

README
What it does:
Who it is for:
How to run it:
What I would do next:

What gets sent back

  • Does not run from the README.
  • Not clearly the person's own work.
  • Claims more than it does.

Resources

Foundationstart here

Depthgo deeper

What a verifier looks for

  • Only your own app was tested.
  • Findings have proof.
  • Fixes are in the code.
  • Check that the work is the person's own.

You'll sign in first, then come straight back here.

Part of