Computer Security — ZeroCourse

reading · we frame, you read MIT or the canonical taught · we author, no canonical fits ↺ spirals back to earlier lessons

Course locked

Complete Performance Engineering of Software Systems (MIT 6.172) first.

This course unlocks once you've finished its prerequisite. Open prerequisite →

Prerequisites

Network Fundamentals and Application Layer not yet

Database Systems not yet

Complete prerequisites first to enroll.

reading · 30 min + ~200 min canonical

The Security Mindset: CIA, Threats, and Thinking Like an Attacker

Every other course in this curriculum has asked "how do I make this work?" Security asks a different, harder question: "how could this be made to fail — deliberately, by someone w…

primary PortSwigger Web Security Academy

preview →

reading · 35 min + ~200 min canonical L1

Authentication: Proving Who You Are

Authentication is the front door of every system — the moment where an anonymous request has to prove it belongs to a specific person — and it is where an enormous fraction of rea…

primary PortSwigger Web Security Academy

after L1 locked

reading · 35 min + ~200 min canonical L1

Authorization and Federated Identity: What You're Allowed to Do

Authentication answered who you are. Authorization answers a completely different and equally critical question: what are you allowed to do? — and confusing the two is the source …

primary PortSwigger Web Security Academy

after L2 locked

reading · 40 min + ~200 min canonical L1

The OWASP Top 10: How Web Apps Actually Get Broken

There is a document that, if every web developer read and internalized it, would prevent the majority of real-world breaches: the OWASP Top 10, a ranked list of the vulnerability …

primary PortSwigger Web Security Academy

after L3 locked

reading · 35 min + ~200 min canonical L1

Defense in the Browser and the Pipeline: CSRF, CSP, CORS, and Secure-by-Default

The final lesson of Computer Security is about the layers — the defenses that don't prevent a single attack so much as build walls around whole categories of them, in the two plac…

primary PortSwigger Web Security Academy

after L4 locked

exercise reading · 15 min L1

Exercises: Easy (Warm-up)

- [ ] PS Lab: SQL Injection — Retrieve hidden data by modifying a SQL query — PortSwigger Apprentice - [ ] PS Lab: Reflected XSS — Inject JavaScript into a search parameter — Port…

after L5 locked

exercise reading · 30 min L1

Exercises: Medium (Core)

- [ ] PS Lab: Blind SQL Injection with conditional responses — PortSwigger Practitioner - [ ] PS Lab: Stored XSS — Inject persistent JavaScript in a comment — PortSwigger Practiti…

after L6 locked

exercise reading · 45 min L1

Exercises: Hard (Stretch)

- [ ] PS Lab: Blind XXE with out-of-band data exfiltration — PortSwigger Expert - [ ] PS Lab: HTTP Request Smuggling — CL.TE and TE.CL attacks — PortSwigger Expert - [ ] PS Lab: P…

after L7 locked

exercise reading · 60 min L1

Mini-Project

- [ ] Build a deliberately vulnerable Rails app (like DVWA) — Include SQL injection, XSS, CSRF, insecure auth, broken access control; then build the secure version with all fixes …

after L8 locked

L10

project reading · 480 min L1

Project: Vulnerable Rails App + Fixes

Build a small Rails app with intentional OWASP Top 5 vulnerabilities (SQL injection, XSS, CSRF bypass, broken auth, insecure direct object references). Then create a branch with a…

after L9 locked

L11

project reading · 600 min L1

Capstone: Security-Hardened Web Application with Pen Test Report

- [ ] Milestone 1: Security audit — run Brakeman, bundler-audit, check OWASP Top 10 - [ ] Milestone 2: Pen test — attempt SQL injection, XSS, CSRF, auth bypass on the app - [ ] Mi…

after L10 locked

L12

assessment reading · 63 min L1

Self-Assessment: Computer Security

- [ ] Explain SQL injection. How do parameterized queries prevent it? - [ ] Explain XSS (cross-site scripting). What is the difference between reflected and stored XSS? - [ ] Expl…

after L11 locked

12 lessons. Read in order; spiral back when you need to. By the end you'll have used the core ideas twice — once on the abstract, once on something you'll meet at work next week.