International Cybersecurity and Digital Forensics Academy

Web Application Security Fellowship (Phase 1 - Track A)

This repository contains all labs, code samples, vulnerable applications, and resources for the 6-Month Web Application Security fellowship track. This program provides a comprehensive deep-dive into web application security, from Linux fundamentals to professional penetration testing and reporting.

📚 Program Overview

• Track: Web Application Security (Phase 1 - Track A)
• Total Duration: 26 Weeks
• Total Credit Units: 37 Units
• Core Environment: Kali Linux & Lab VMs

---

🗂 Repository Structure

was-fellowship-phase1/
│
├── 📄 README.md                          # This file
├── 📄 LICENSE
├── 📁 CODE_OF_CONDUCT.md
├── 📁 CONTRIBUTING.md
│
├── 📁 COURSE-1-BVWS101-LINUX-NETWORKING-BASH/
│   ├── 📁 WEEK-1-LINUX-BASICS/
│   │   ├── 📁 labs/
│   │   │   ├── 📄 LAB_GUIDE.md
│   │   │   ├── 📁 exercises/
│   │   │   └── 📁 solutions/
│   │   ├── 📁 slides/
│   │   └── 📁 resources/
│   ├── 📁 WEEK-2-USERS-PERMISSIONS/
│   ├── 📁 WEEK-3-NETWORKING-FUNDAMENTALS/
│   └── 📁 WEEK-4-BASH-SCRIPTING/
│
├── 📁 COURSE-2-BVWS102-WEB-ESSENTIALS/
│   ├── 📁 WEEK-1-HTTP-HTTPS/
│   ├── 📁 WEEK-2-HTML-CSS-JS/
│   ├── 📁 WEEK-3-APP-COMPONENTS/
│   ├── 📁 WEEK-4-VULN-OVERVIEW/
│   └── 📁 WEEK-5-SSL-TLS/
│
├── 📁 COURSE-3-BVWS103-OWASP-TOP-10/             # !! Use in controlled VMs only !!
│   ├── 📁 WEEK-1-INJECTION/
│   │   ├── 📁 labs/
│   │   │   ├── 📄 LAB_GUIDE.md
│   │   │   ├── 📁 sql-injection/
│   │   │   └── 📁 command-injection/
│   │   └── 📁 solutions/
│   ├── 📁 WEEK-2-XSS-CSRF/
│   ├── 📁 WEEK-3-BROKEN-AUTH/
│   ├── 📁 WEEK-4-MISCONFIG-DATA-EXPOSURE/
│   └── 📁 WEEK-5-CTF-CHALLENGES/
│
├── 📁 COURSE-4-BVWS104-SECURE-CODING/
│   ├── 📁 WEEK-1-PRINCIPLES/
│   │   ├── 📁 vulnerable-code/
│   │   └── 📁 secure-code/
│   ├── 📁 WEEK-2-INPUT-VALIDATION/
│   ├── 📁 WEEK-3-CODE-AUDIT/
│   └── 📁 WEEK-4-SDLC-CHECKLIST/
│
├── 📁 COURSE-5-BVWS105-PENTEST-METHODOLOGIES/
│   ├── 📁 WEEK-1-PLANNING-SCOPING/
│   │   └── 📁 templates/
│   ├── 📁 WEEK-2-RECON/
│   ├── 📁 WEEK-3-EXPLOITATION-PRIVESC/
│   └── 📁 WEEK-4-REPORTING/
│       └── 📁 templates/
│
├── 📁 COURSE-6-BVWS106-AUTH-SESSION-MGMT/
│   ├── 📁 WEEK-1-AUTHENTICATION/
│   ├── 📁 WEEK-2-AUTHORIZATION/
│   └── 📁 WEEK-3-SESSION-MGMT/
│
├── 📁 COURSE-7-BVWS107-COMPLIANCE-REPORTING/
│   ├── 📁 WEEK-1-COMPLIANCE-FRAMEWORKS/
│   └── 📁 WEEK-2-REPORTING-REMEDIATION/
│
├── 📁 CAPSTONE-BVWS108-FINAL-PROJECT/
│   ├── 📄 PROJECT_GUIDELINES.md
│   ├── 📁 target-applications/
│   ├── 📁 example-reports/
│   └── 📁 student-submissions/               # Private
│
└── 📁 TOOLS-SETUP/
    ├── 📄 VM-SETUP-GUIDE.md
    ├── 📄 BURP-SETUP.md
    ├── 📄 ZAP-SETUP.md
    └── 📁 config-files/

---

Table of Contents & Lab Index

Course 1: BVWS101 - Foundations of Linux, Networking & Bash Scripting

Week	Lab Code	Activity Name	Status
1	LAB-1.1.3	Lab - Linux CLI Practice: File Navigation & User Permissions	Mandatory
2	LAB-1.2.4	Lab - Hands-on Linux Permission Setting and Management	Mandatory
3	LAB-1.3.6	Lab - Network Diagrams and Subnetting Exercises	Mandatory
4	LAB-1.4.5	Lab - Write Simple Automation Scripts	Mandatory

---

Course 2: BVWS102 - Web Application Security Essentials

Week	Lab Code	Activity Name	Status
1	LAB-2.1.4	Lab - Analyze HTTP Requests/Responses	Mandatory
2	LAB-2.2.3	Lab - Build Simple Webpages	Mandatory
3	LAB-2.3.5	Practice - Identify Potential Security Weaknesses	Mandatory
4	LAB-2.4.2	Lab - Vulnerability Identification Exercises	Mandatory
5	LAB-2.5.4	Lab - Configure SSL on Test Environments	Mandatory

---

Course 3: BVWS103 - OWASP Top 10 Vulnerabilities & Exploitation Techniques

Week	Lab Code	Activity Name	Status
1	LAB-3.1.5	Lab - Hands-on SQLi & Command Injection Exploitation	Mandatory
2	LAB-3.2.6	Lab - Identifying and Exploiting XSS & CSRF	Mandatory
3	LAB-3.3.4	Lab - Testing Authentication Mechanisms	Mandatory
4	LAB-3.4.7	Lab - Vulnerability Scanning with Burp Suite/ZAP	Mandatory
5	LAB-3.5.8	Lab - OWASP Top 10 CTF-Style Challenges	Mandatory

---

Course 4: BVWS104 - Secure Coding Practices and Input Validation

Week	Lab Code	Activity Name	Status
1	LAB-4.1.3	Lab - Code Review of Sample Vulnerable Code	Mandatory
2	LAB-4.2.5	Lab - Implement Secure Validation in Test Code	Mandatory
3	LAB-4.3.6	Lab - Group Code Audit Exercises	Mandatory
4	LAB-4.4.4	Lab - Create a Secure Coding Checklist	Mandatory

---

Course 5: BVWS105 - Web Application Penetration Testing Methodologies

Week	Lab Code	Activity Name	Status
1	LAB-5.1.4	Lab - Write a Penetration Test Plan	Mandatory
2	LAB-5.2.5	Lab - Conduct Footprinting and Scanning	Mandatory
3	LAB-5.3.6	Lab - Hands-on Exploitation and Privilege Escalation	Mandatory
4	LAB-5.4.3	Lab - Write a Penetration Testing Report	Mandatory

---

Course 6: BVWS106 - Authentication, Authorization, and Session Management

Week	Lab Code	Activity Name	Status
1	LAB-6.1.4	Lab - Testing Common Authentication Flaws	Mandatory
2	LAB-6.2.5	Lab - Implement Access Control Rules	Mandatory
3	LAB-6.3.3	Lab - Analyze Session Handling & Mitigation	Mandatory

---

Course 7: BVWS107 - Compliance, Reporting, and Remediation

Week	Lab Code	Activity Name	Status
1	LAB-7.1.4	Lab - Study PCI-DSS & GDPR Case Studies	Mandatory
2	LAB-7.2.6	Lab - Produce a Final Pentest Report & Remediation Plan	Mandatory

---

Capstone Project: BVWS108 - Web Application Penetration Testing

Component	Link	Status
Guidelines	CAPSTONE-GUIDELINES	Mandatory
Target Applications	TARGET-APPS	Mandatory
Report Template	REPORT-TEMPLATE	Mandatory

---

⚠️ Ethical Use Warning

This repository contains materials for educational purposes only.

• All labs, especially in COURSE-3-BVWS103-OWASP-TOP-10, must be conducted in a controlled, isolated environment.
• Never test on systems or applications you do not explicitly own or have written permission to test.
• By using this repository, you agree to use these skills and tools ethically and legally.

---

🛠 Tools & Setup

Detailed setup guides for all required tools (Kali Linux, Burp Suite, OWASP ZAP, Docker, etc.) can be found in the TOOLS-SETUP directory.

---

👥 Contributing & Support

1. Read the Guides: Please read CONTRIBUTING.md and CODE_OF_CONDUCT.md first.
2. Reporting Issues: Found a bug in a lab? Open a detailed Issue.
3. Discussions: For questions and help, use the GitHub Discussions tab.

For other inquiries, please contact us at resources@aivtic.org.ng.

---

📜 License

This repository's original educational content is licensed under the Creative Commons Attribution-NonCommercial 4.0 International (CC BY-NC 4.0) license. All third-party tools and vulnerable applications are subject to their own licenses.