Application Security Study Plan

Phase 1 — Foundations (How Applications Really Work)

Goal: Understand how modern applications are built, communicate, and fail.

• HTTP request/response lifecycle
• State management (cookies, sessions, tokens)
• Client vs server trust boundaries
• What the browser enforces vs what the server must enforce

Study:

• Web Application Security Overview
• Sessions & Cookies
• Secure Code Review Basics

Interview focus: “Explain how a web application works end-to-end and where security controls belong.”

Phase 2 — Core Web Vulnerabilities (Depth > Breadth)

Goal: Stop memorizing OWASP. Start understanding exploit mechanics.

• Injection as a class (SQLi, NoSQLi, OS, LDAP, XPath)
• Contextual output encoding
• Server-side vs client-side validation

Study (deeply):

• SQL Injection
• Cross-Site Scripting (XSS)
• Command Injection
• XXE
• SSRF

Hands-on mindset: Always ask: What is the sink? What controls the input? Why does the fix work?

Interview focus: “Explain SQLi/XSS from request to database/DOM with a real example.”

Phase 3 — Authentication & Identity (High-Impact Area)

Goal: Understand how identities break — not just how they authenticate.

What I see in reviews: consistency beats intensity. Ten focused minutes per day on one boundary/bug class will outperform random deep dives.

• Password storage & reset flows
• MFA logic flaws
• JWT internals (claims, signing, verification)
• OAuth & SSO trust boundaries

Study:

• Web Authentication
• JWT Security
• OAuth & SSO
• Multi-Factor Authentication
• Password Reset Flows

Interview focus: “Explain JWT validation. What goes wrong in real systems?”

Phase 4 — Authorization & Business Logic (experienced-Level Skill)

Goal: Catch bugs scanners will never find.

• Authorization vs authentication
• IDOR / BOLA / BFLA
• Workflow abuse
• State manipulation

Study:

• Authorization
• Business Logic Vulnerabilities
• CSRF

Interview focus: “How do you find business logic bugs?”

Phase 5 — API, Mobile & Cloud Expansion

Goal: Apply the same mental models beyond classic web apps.

• API object-level authorization
• Token misuse
• Mobile trust assumptions
• Cloud shared responsibility

Study:

• API Security
• Mobile Security
• Cloud Security

Interview focus: “How is API security different from web security?”

Phase 6 — experienced AppSec Skills

Goal: Think like a security owner, not just a tester.

• Threat modeling (STRIDE)
• Secure SDLC integration
• Risk-based prioritization
• Writing high-quality reports

Study:

• Threat Modeling
• Security Reporting
• Security Standards

Interview focus: “How do you influence engineering teams and leadership?”