Web Application Security — Lab Portfolio

Twenty-five lab reports from the International Cybersecurity and Digital Forensics Academy (ICDFA), Web Application Security & Digital Forensics phase — modules BVWS101 to BVWS103 plus BVWS105 and BVWS106, completed October 2025 to April 2026. Every report is committed in this repository under reports/, so the portfolio is fully self-contained.

Scope note: all exercises were performed on ICDFA-authorised lab environments and intentionally vulnerable local targets. No production, third-party or unauthorised system was ever tested.

Skills & tools

• Linux system administration: users and groups, file permissions, process control, Bash scripting and automation
• Networking: OSI model, IP addressing and subnetting, reconnaissance and service/vulnerability mapping with nmap
• Web application security: OWASP Top 10 exploitation and remediation — SQL injection, XSS, command injection, insecure deserialization, security misconfiguration, sensitive data exposure, logging gaps
• Penetration testing: OWASP penetration testing methodology — scoping, discovery, exploitation and structured reporting
• Secure development: secure coding practices and input validation — parameterised queries, output encoding, allow-list validation
• Lab environments: Kali Linux, XAMPP web stacks, isolated virtual lab networks

BVWS101 — Foundations: Linux, Networking & Bash Scripting

#	Lab	Date	Summary	Report
1	Basic commands & file system	2025-10-13	Core Linux shell navigation and file/directory management, demonstrated hands-on.	PDF
2	Linux system administration	2025-10-20	Configured users, groups, permissions and processes on a Linux host.	PDF
3	OSI model cyberlab	2025-10-27	Mapped observed network behaviour to OSI layers in a guided cyberlab.	PDF
4	IP addressing lab exercise	2025-10-27	Calculated and validated IP addressing and subnetting schemes for lab networks.	PDF
5	Bash scripting lab exercise	2025-11-03	Automated routine administration tasks with shell scripts.	PDF

BVWS102 — Web Application Security Essentials

#	Lab	Date	Summary	Report
1	OSI model cyberlab (web stack)	2025-10-27	Applied OSI layering to diagnose a simulated web application stack.	PDF
2	Web application security essentials	2025-11-10	Core web application security concepts and the failure modes behind them.	PDF
3	PHP backend development with SQL database	2025-11-17	Built a PHP/SQL backend and identified how query handling introduces injection risk.	PDF
4	OWASP Top 10 web vulnerabilities	2025-11-24	Mapped the OWASP Top 10 categories to practical lab examples.	PDF
5	Virtual lab environment setup	2025-12-22	Stood up an isolated virtual lab network for safe web security practice.	PDF
6	Web application reconnaissance	2025-12-28	Performed authorised reconnaissance against lab targets and documented the exposed surface.	PDF
7	Nmap mastery and vulnerability mapping	2026-01-04	Produced host, service and vulnerability maps with nmap against lab targets.	PDF
8	Final project: web application security	2025-12-04	End-to-end assessment of a lab web application combining reconnaissance, enumeration and a findings report.	PDF

BVWS103 — OWASP Top 10: Vulnerability & Exploitation Techniques

#	Lab	Date	Summary	Report
1	XAMPP installation on Kali	2026-01-22	Deployed a local vulnerable web stack (XAMPP) as the exploitation target for the module.	PDF
2	HTML injection	2026-01-25	Injected HTML into unsanitised input, documented rendering impact and the fix.	PDF
3	Advanced SQL injection	2026-01-25	Extracted data from a lab application via union- and boolean-based SQL injection.	PDF
4	Command injection	2026-01-25	Achieved OS command execution through unsanitised input and specified input-validation controls.	PDF
5	Cross-site scripting (XSS)	2026-02-01	Executed reflected and stored XSS payloads and demonstrated cookie-theft impact.	PDF
6	Insecure deserialization	2026-02-01	Exploited unsafe object deserialization to alter application behaviour.	PDF
7	Security misconfiguration	2026-02-01	Identified and exploited default and misconfigured settings; listed hardening steps.	PDF
8	Sensitive data exposure	2026-02-08	Located exposed sensitive data and recommended encryption and access controls.	PDF
9	Using components with known vulnerabilities	2026-02-08	Exploited a component with published CVEs and documented the patching path.	PDF
10	Insufficient logging & monitoring	2026-02-15	Demonstrated attacker actions escaping detection and specified monitoring improvements.	PDF

BVWS105 — OWASP Penetration Testing Methodology

#	Lab	Date	Summary	Report
1	OWASP penetration testing methodology	2026-04-09	Applied the OWASP penetration testing methodology — scoping, discovery, exploitation and reporting — against an authorised lab target.	PDF

BVWS106 — Secure Coding Practices & Input Validation

#	Lab	Date	Summary	Report
1	Secure coding practices and input validation	2026-04-29	Applied secure coding controls — parameterised queries, output encoding and allow-list input validation — to remediate injection-class flaws in a lab application.	PDF

Repository layout

reports/
├── BVWS101/   Linux, networking and Bash foundations (5 reports)
├── BVWS102/   Web application security essentials (8 reports)
├── BVWS103/   OWASP Top 10 exploitation techniques (10 reports)
├── BVWS105/   OWASP penetration testing methodology (1 report)
└── BVWS106/   Secure coding practices and input validation (1 report)

Related work

• PortSwigger Web Security Academy writeups — XSS and CSRF lab walkthroughs
• SBT-DF203 Lab 3 — SYN Flood Attack Investigation Using tshark
• CIP-B102 Lab 3 — Data Carving with XXD, Binwalk and Scalpel

Author

Nebeuwa Ifeanyichukwu Raphael — digital forensics and cyber-defence trainee, International Cybersecurity and Digital Forensics Academy (ICDFA).