Day 1: Introduction to Web Application Security

• Fundamental concepts of web security: Presentation of the basic principles of web security, including data confidentiality, integrity and availability.
• Evolution of threats and attacks: Analysis of the evolution of threats in the digital landscape, including recent trends in attacks on web applications.

Day 2: Web Application Vulnerabilities

• SQL injection: identification and exploitation: Understanding SQL injection attacks, how they occur and methods for identifying and preventing them.
• Cross-Site Scripting (XSS): types and protection: Exploration of the different types of XSS attacks (stored, reflected, DOM-based) and protection strategies.
  Cross-Site Request Forgery (CSRF): mechanisms and
• prevention: Study of CSRF mechanisms and best practices for defending against these attacks.

Day 3: Ethical Hacking Techniques

• Penetration testing methodologies: Introduction to the stages of penetration testing, including reconnaissance, discovery, exploitation and reporting.
• Security frameworks and standards (OWASP, NIST): Presentation of recognised security standards such as OWASP Top Ten and NIST SP 800 to guide security practices.

Day 4: Security Testing Tools

• Tools overview: Introduction to popular tools such as Burp Suite and OWASP ZAP, their functionalities and their use in security testing.
• Using the tools to analyse application security: Practical workshops on using these tools to identify vulnerabilities in web applications.

Day 5: Practical Hacking Exercises

• Simulated attacks on controlled environments: Setting up a secure environment where participants can practise simulated attacks without risk.
• Analysis and exploitation of vulnerabilities: Practical exercises to analyse the results obtained during the simulations and understand how to exploit vulnerabilities effectively. 
• Suggested solutions for correcting vulnerabilities: Discussion of best practices for remedying vulnerabilities identified during testing.
• Implementing secure development practices: Recommendations for integrating security into the software development lifecycle.
• Analysis of real cases of attacks on web applications: In-depth study of real incidents, including causes, impacts and lessons learned.
• Discussion of lessons learned and best practices: Synthesis of the knowledge acquired during the course, with a focus on continuous improvement in security.
• This programme offers a comprehensive approach to understanding and applying security in web application development, combining theory, practice and case