Build Node.js and React apps that resist XSS, injection, broken authentication and broken access control
Put this course to work on real challenges and in-browser labs. Each CTF category is a trek through the Himalaya, climbed one stop at a time. Free to play.
Most security breaches start with an ordinary bug in an ordinary web app: a query built by string concatenation, a page that renders user input as HTML, an API that forgets to check who is asking. This course teaches you to write JavaScript and TypeScript web apps that do not have those bugs.
You will learn to think about trust boundaries, validate input and encode output so cross-site scripting cannot happen, talk to databases without injection risk, store passwords and manage sessions properly, check authorization on every request, and keep secrets, dependencies and HTTP headers in good shape. Every lesson shows the vulnerable pattern next to the fix, using Node.js, Express and React.
The course ends with a hands-on audit: you review a small Express app, find its flaws and fix them. Pair it with the Annapurna Circuit (Web) trek on NepSec CTF to see the same bugs from the attacker's side.
4 sections, 8 lessons, 11m total
Incident response engineer in Kathmandu and builder of NepSec
I'm an incident response engineer at Stellar Computer Systems (SCS) in Kathmandu, where I lead incident response, analyse threats and advise clients on their security posture. My work spans security operations, threat detection, threat intelligence, security engineering and vulnerability assessment. I'm listed in Apple's Security Hall of Fame for responsibly disclosing vulnerabilities in Apple's infrastructure, and I hold certifications from Microsoft, Fortinet, Cisco, Google, CrowdStrike and The SecOps Group. When the tools I need don't exist, I build them. That's how NepSec Intel, NepSec Academy and NepSec CTF came to be. My courses teach the same practical skills I use at work, and NepSec CTF is where you put them to the test.
5 published courses
No reviews yet. Enrolled students can leave the first one.
No. Most examples use Node.js and Express. React appears only in the XSS lesson, and the ideas apply to any framework.
No, it is a secure development course. You learn how common attacks work so you can prevent them in your own code. For the attacker's side, try the Annapurna Circuit (Web) trek on NepSec CTF.
Yes. Complete every lesson, pass the quiz and submit the code-audit assignment to earn a certificate of completion.