Back
Keentune
Security curriculum 26 chapters
·
231 concepts
·
free
Everything the adaptive question bank can teach and test in Security, from foundations through advanced practice. Work through it in order, or start practicing and let the questions find your level.
Start practicing Security
New here? Read the Security guide A free 18-minute primer — the mental model, the mistakes beginners make, and what to practice first.
A. Security principles and the trust model •
Confidentiality, integrity and availability; most controls trade one against another.
•
Grant the minimum rights, to the fewest actors, for the shortest time.
•
Layered independent controls, so a single failure is not a breach.
•
An error path must deny; an exception that skips the check is an allow.
•
The shipped configuration is the one most deployments will keep forever.
•
Every access is authorized, not just the first one in a session.
•
Hiding an endpoint delays discovery; it never authorizes access.
•
The point where data changes trust level is where validation must happen.
•
Network location grants nothing; every request is authenticated and authorized.
Practice this section →
B. Threat modeling and risk •
Spoofing, tampering, repudiation, information disclosure, denial of service, elevation.
•
Model processes, stores, flows and boundaries before enumerating threats.
•
The count of reachable entry points, not the count of known bugs.
•
A critical weakness in unreachable code is not a critical risk.
•
The feature working exactly as designed, turned against the business.
•
Design for containment after compromise, not only for prevention.
•
Accepted risk is a documented decision with an owner, not an absence of risk.
•
A flaw in the design cannot be patched by fixing a line of code.
Practice this section →
C. Vulnerability taxonomy and the OWASP Top 10 •
The Top 10 ranks awareness categories; ASVS is the testable standard.
•
The failure is missing or misapplied protection, rarely a broken cipher.
•
The 2025 edition promoted software supply chain to its own category.
•
One concrete bug maps to several categories, so learn the cause not the number.
•
CWE names a weakness class; CVE identifies one instance in one product version.
•
The base score ignores your exposure and compensating controls.
•
A weakness, a working attack against it, and the actor who would run it.
•
L1 opportunistic, L2 the standard target for most applications, L3 high assurance.
Practice this section →
D. API security •
Broken object-level authorization: ownership is re-checked per object, not once per route.
•
Broken function-level authorization: an admin action reachable by guessing the method or path.
•
Binding a request body straight onto a model lets a caller set fields like isAdmin .
•
Returning the whole record and filtering in the client still leaks it.
•
No rate, size or cost limit turns your own API into the denial-of-service weapon.
•
Automating a legitimate flow at scale (bulk signup, scalping) is an API risk.
•
The forgotten v1 host and the staging deployment are the ones that get hit.
•
A response from a third-party API is untrusted input and needs the same validation.
•
The gateway validates the token; the service still authorizes the object.
Practice this section →
E. Access control and authorization •
Who you are versus what you may do; a valid token is not a permission.
•
Hiding a button is user experience, not access control.
•
A direct object reference the server accepts without an ownership check.
•
A UUID raises the guessing cost; it does not check ownership.
•
Reaching another user's data at the same privilege level.
•
Reaching a function reserved for a higher role.
•
Anything not explicitly permitted is refused, including routes added later.
•
Coarse roles versus attribute and context rules, and where each stops scaling.
•
A 403 confirms the object exists; a 404 keeps even that secret.
Practice this section →
F. Injection •
Injection is data crossing into the instruction position of an interpreter.
•
Binding sends values out of band, so they can never be parsed as SQL.
•
Escaping depends on charset, context and dialect; binding does not.
•
No output, so the attacker reads the database through boolean or timing differences.
•
Input stored safely on write and injected when a later query reads it back.
•
An operator object such as a $ne document injected where a scalar was expected.
•
Pass an argument vector; a shell string re-parses metacharacters as syntax.
•
Dot-dot segments and their encodings; canonicalize first, then check the prefix.
•
User input rendered as a template is server-side code execution, not merely XSS.
•
An external entity in XML reads local files or reaches internal hosts; disable DTD processing.
•
A byte stream that instantiates types becomes a gadget chain to code execution.
Practice this section →
G. Cross-site scripting and output encoding •
Untrusted data rendered where the browser parses it as markup or code.
•
Echoed back from one request versus persisted and served to every later viewer.
•
The sink is in client JavaScript, so the payload may never reach the server at all.
•
HTML body, attribute, URL, JavaScript and CSS each need a different escape.
•
innerHTML , document.write , eval and a javascript: URL all re-enter a parser.
•
The same string is harmless in one output context and hostile in another.
•
Sanitize with a real HTML parser; a regex blocklist is always bypassable.
•
The browser rewrites markup after sanitization and resurrects a neutralized payload.
Practice this section →
H. The browser security model, CORS and response headers •
Scheme, host and port must all match for scripted cross-document access.
•
CORS tells the browser it may expose a response; it is not server-side access control.
•
Echoing whatever Origin arrives re-implements a wildcard and defeats CORS.
•
Non-simple methods, headers or content types trigger an OPTIONS check first.
•
A policy constrains which sources may run, capping the impact of an injection.
•
Per-response nonces beat host allowlists, which are routinely bypassed.
•
Allowing inline script restores exactly what the policy was there to block.
•
The real UI framed under a decoy; deny framing with frame-ancestors.
•
The browser refuses plaintext for the host after the first successful visit.
•
A hash pins the exact third-party file the page is allowed to execute.
•
A full URL in the Referer header leaks tokens and internal paths to third parties.
Practice this section →
I. CSRF, SSRF and the confused deputy •
A trusted component is tricked into using its authority on the attacker's behalf.
•
The browser attaches ambient credentials to a cross-site request the user never intended.
•
An unguessable per-session value the attacker's page can neither read nor predict.
•
Lax blocks most cross-site sends; Strict also breaks legitimate inbound links.
•
The request is still delivered; only the response is withheld from script.
•
The server fetches an attacker-chosen URL from a position inside the network.
•
The link-local instance metadata endpoint hands out cloud credentials.
•
Decimal, octal, IPv6 and redirect encodings defeat every deny list.
•
An unvalidated redirect target launders phishing and leaks tokens left in the URL.
Practice this section →
J. Authentication, sessions and cookies •
Something you know, have or are; two factors from one class is not MFA.
•
A stolen password on its own stops being enough to sign in.
•
A shared seed and a 30-second window can be relayed by a proxy in real time.
•
SIM swap and telecom interception make SMS the weakest second factor.
•
The authenticator signs the origin, so a look-alike site cannot replay it.
•
The server stores only a public key, so a database dump yields nothing to replay.
•
Reused breach credentials replayed at scale, which is not guessing.
•
Different messages, status codes or response times leak which accounts exist.
•
A predictable or sequential session identifier is an authentication bypass.
•
Failing to issue a new session at login is session fixation.
•
Secure, HttpOnly and SameSite each prevent a different, specific attack.
•
Clearing the cookie leaves the session record usable by anyone holding a copy.
Practice this section →
K. Password and credential storage •
Storage must be one-way; encryption is reversible by whoever holds the key.
•
SHA-256 is designed to be fast, which is precisely the attacker's advantage.
•
Bcrypt, scrypt, PBKDF2 and Argon2id are deliberately and tunably slow.
•
A unique random salt defeats rainbow tables and hides identical passwords.
•
A secret held outside the database, so a table dump alone is not crackable.
•
Raise the cost parameter as hardware improves, re-hashing on next login.
•
Input past 72 bytes is silently ignored, so long passphrases collide.
•
NIST guidance favors long passphrases and drops forced periodic rotation.
•
Reject known-compromised passwords instead of adding character-class rules.
Practice this section →
L. Tokens: OAuth 2.0, OIDC and JWT •
The payload is Base64url and readable by anyone holding the token.
•
Trusting the token's own algorithm header lets an attacker strip the signature entirely.
•
Verifying with the public key as an HMAC secret forges arbitrary tokens.
•
A correct signature from the wrong issuer, or for another audience, is still wrong.
•
A stateless token stays valid until it expires; you need short TTLs or a deny list.
•
It delegates access on your behalf; on its own it is not a login protocol.
•
The ID token is the assertion about the user; an access token never is.
•
The code travels through the browser, the token through the back channel.
•
A verifier and its challenge stop an intercepted authorization code from being redeemed.
•
An unguessable value ties the callback to the request and blocks login CSRF.
•
Reuse of an already-rotated refresh token signals theft and revokes the whole family.
•
localStorage is readable by any injected script; an HttpOnly cookie is not.
Practice this section →
M. Cryptography fundamentals •
Base64 and hex are reversible by anyone, with no key involved.
•
A digest cannot be inverted, only guessed at and compared.
•
One shared key versus a keypair, and the order-of-magnitude speed gap.
•
AES is a block cipher; the mode of operation decides what the ciphertext leaks.
•
Identical plaintext blocks produce identical ciphertext blocks.
•
Reusing a nonce under one key in GCM or CTR destroys confidentiality and authenticity.
•
GCM and ChaCha20-Poly1305 provide confidentiality and integrity as a single primitive.
•
A MAC proves a shared secret; a signature proves a private key and is non-repudiable.
•
Ordinary random functions are predictable; tokens need a cryptographic generator.
•
Ephemeral key agreement means a later private-key theft cannot decrypt old traffic.
•
Recorded traffic is the post-quantum threat, so key agreement migrates first.
Practice this section →
N. Key management and cryptographic misuse •
Use a vetted library and a standard construction; novel crypto fails under review.
•
A human secret must pass through a KDF before it can serve as key material.
•
Rotation bounds the window a compromised key covers, and needs a re-wrapping plan.
•
A data key encrypts the data; a managed root key encrypts the data key.
•
The key operates inside hardware and never exists in application memory.
•
Distinguishable decryption failures let an attacker recover plaintext without the key.
•
Secret-dependent branches and comparisons leak; use constant-time primitives.
•
A low-entropy identifier such as an email or phone number is trivially brute-forced.
Practice this section →
O. PKI and TLS •
A CA asserts that this public key belongs to this hostname.
•
The client validates a path from the leaf to a root it already trusts.
•
Hostname match, validity dates, chain and revocation are independent checks.
•
CRLs go stale and OCSP fails open; stapling and short lifetimes work better.
•
Pinning defeats a mis-issuing CA and bricks the client when the pinned key changes.
•
Authenticate the server, agree a fresh key, then switch to symmetric encryption.
•
Static RSA key exchange and the legacy ciphers are gone, making forward secrecy mandatory.
•
Both peers present certificates, so the client is authenticated by key rather than password.
•
An attacker forces plaintext or an older version; HSTS and a version floor stop it.
Practice this section →
P. Network and infrastructure security •
It tracks connections, so return traffic needs no separate inbound rule.
•
Outbound filtering is what turns an implant or an SSRF into a dead end.
•
A flat network converts one compromised host into access to everything.
•
One observes and alerts, the other sits inline and can drop the traffic.
•
Signatures buy time to patch; they never fix the vulnerable code.
•
Address translation hides addresses; it enforces no security policy.
•
It gives record integrity and origin authentication, not confidentiality.
•
An open admin service with a default credential is the entire breach.
Practice this section →
Q. Cloud, container and Kubernetes security •
The provider secures the infrastructure; configuration and data stay yours.
•
A wildcard action on a wildcard resource is the cloud equivalent of running as root.
•
An assumed role expires; a static access key committed to a repo does not.
•
Misread bucket policies and ACLs are a recurring whole-dataset exposure.
•
Credentials reachable over plain HTTP from inside the workload.
•
Namespaces and cgroups share one kernel, so a kernel bug is a full escape.
•
A root process in a container plus a host mount is a host compromise.
•
Scanning finds known CVEs; admission-time signature checks enforce provenance.
•
Secrets are Base64, not encrypted, unless encryption at rest is switched on.
•
Every pod can reach every pod until a NetworkPolicy says otherwise.
Practice this section →
R. Software supply chain •
Most of your shipped code is code nobody on the team has read.
•
A package whose name is one character away from the one you meant.
•
A public package shadowing a private name the resolver prefers.
•
Pinning plus integrity hashes is what makes a build reproducible.
•
Installing a package executes its code before you ever import it.
•
A component inventory is what lets you answer a new CVE in minutes rather than weeks.
•
Attest how an artifact was built, and verify that attestation at deploy time.
•
Build runners hold deploy credentials and are a first-class target.
Practice this section →
S. Secure SDLC and security testing •
A flaw caught in design costs orders of magnitude less than one caught in production.
•
Analyzes source without executing it; strong on patterns, noisy with false positives.
•
Attacks the running application; sees real behavior, misses code it cannot reach.
•
Matches your declared dependencies against known-vulnerability databases.
•
Malformed input at volume, which is how parser and memory bugs actually surface.
•
A human chaining several weaknesses versus an automated signature sweep.
•
Every fixed vulnerability becomes a test that fails if it ever returns.
•
A published reporting channel and a fix timeline, not legal threats.
Practice this section →
T. Attack lifecycle, detection and incident response •
Recon, weaponize, deliver, exploit, install, command and control, act on objectives.
•
ATT&CK catalogs observed tactics and techniques, so you can map detection coverage.
•
Phishing, exposed services, valid accounts and trusted third parties dominate.
•
After access, the attacker's next goal is surviving a reboot and a password reset.
•
Reused local administrator credentials are how one host becomes the whole estate.
•
Unusual volume, destination and timing over egress, not suspicious file names.
•
SP 800-61r3 (April 2025) rebuilt the life cycle on the six CSF 2.0 Functions — Govern, Identify, Protect, Detect, Respond, Recover — and maps the older preparation / detection & analysis / containment-eradication-recovery / post-incident phases onto them.
•
Containment prevents an incident expanding and comes first; deliberately delaying it to watch an attacker and gather evidence is a legal-sign-off decision, not a default, because the delay lets them escalate.
•
Three copies, two media, one offline; a mounted backup gets encrypted too.
Practice this section →
U. Secrets, logging and data protection •
Git history keeps a committed key forever, so rotate rather than delete.
•
Central storage with an access policy, an audit trail and automated rotation.
•
Environment values leak through the process tree, crash dumps and logs.
•
Catch the credential before the push, and keep scanning every push afterwards.
•
A leaked secret is compromised whether or not you saw anyone use it.
•
Authentication, authorization failures and admin actions, with enough context.
•
Tokens, passwords and card numbers get replicated across every log store.
•
Data you never collected cannot be breached, subpoenaed or mishandled.
Practice this section →
V. Email and domain security •
The base protocol lets any host claim any sender address.
•
A DNS record listing the hosts permitted to send, checked against the envelope sender.
•
A signature over selected headers and the body, verified with a public key published in DNS.
•
A policy layered on SPF and DKIM, plus aggregate reporting back to the domain owner.
•
SPF or DKIM must pass for the visible From domain, not merely for some domain.
•
Start at none for visibility, then quarantine, then reject.
•
A sender logo requires DMARC at enforcement and, at some mailboxes, a verified mark.
Practice this section →
W. Memory safety and the low-level weakness class •
The program reads or writes memory it does not own.
•
Writing past a fixed buffer overwrites saved registers and the return address.
•
Corrupting allocator metadata escalates into an arbitrary write.
•
A dangling pointer used after the allocation was handed to someone else.
•
A wrapped size calculation allocates less than the copy will write.
•
User data used as a format specifier both reads and writes process memory.
•
Randomize the layout, mark data non-executable, detect a smashed stack.
•
Bounds checks or ownership rules trade runtime or compile cost for safety.
Practice this section →
X. Privacy, compliance and governance •
An audit proves controls exist, not that they stop an attacker.
•
Personal data needs a stated basis and may not drift to a new purpose.
•
The deadline runs from awareness, not from the day you finish the fix.
•
The smaller the cardholder-data environment, the smaller the assessment.
•
Health data plus identifiers, requiring access control and audit logs.
•
The report tests the controls you defined, operating over a period.
•
Deletion that misses derived copies and backups is not deletion.
Practice this section →
Y. File upload and handling •
The Content-Type on an upload is set by the client and is trivial to spoof, so it is a convenience check and never a security control.
•
Validate the extension AFTER decoding the filename and against an allowlist; a block-list falls to double extensions like .jpg.php and to null bytes like .php%00.jpg .
•
Magic-byte validation belongs beside content-type and extension checks, because bypassing a signature check on its own is common and easy.
•
A client-supplied name can carry traversal segments, reserved device names or characters the filesystem treats specially, so store under a name the server generates.
•
Keeping uploads on a different host segregates the application from the file store; the weaker forms are a separate volume and, last, a path the web server will not execute.
•
A size limit measured on the uploaded bytes does not bound a zip bomb; the budget that matters is the size after extraction.
•
A publicly retrievable store adds disclosure of other files, an amplification DoS where small requests return large responses, and liability for whatever users host on you.
Practice this section →
Z. Automated abuse of valid functionality •
An automated threat exploits no flaw: the application does exactly what it was specified to do, at machine speed and scale, so neither a scanner nor a code review will find it.
•
OAT-021 depletes stock without completing the purchase, so carts, seats or appointments sit reserved and real customers are turned away.
•
OAT-005 obtains limited-availability or preferred goods by unfair methods; the transaction is valid, the allocation is not.
•
OAT-011 collects application content for use elsewhere; every individual request is legitimate and the aggregate is the harm, which is why per-request rules do not catch it.
•
OAT-018 probes the application to identify its constituents and properties, while OAT-004 elicits the software and framework types and versions; the first maps what you have, the second names it.
•
OAT-010 fills in missing expiry dates and security codes, OAT-001 verifies bulk stolen cards through repeated authorization attempts, and OAT-012 spends the ones that validated; the middle step is the one your payment endpoint sees.
•
OAT-016 repeats clicks, page requests or form submissions to move a metric, so the asset under attack is your analytics and whatever decisions rest on them.
•
OAT-009 is solving anti-automation tests, which is a service others sell; treat a CAPTCHA as friction with a price, never as a boundary.
Practice this section →
Keentune is not affiliated with or endorsed by the organizations whose documentation informs these maps.
Start practicing Security
All about Security practice
Browse all free study guides
All exam, test, and product names and trademarks are the property of their respective owners and are used here for identification and reference only. Keentune is independent study practice — not affiliated with, authorized, or endorsed by any of these organizations.
© 2026 SportaApp LLC