Learning security through insecurity

Web programming courses typically contain the “how to implement functionality” of developing web applications, and writing a simple one is not very difficult. But this leads to lots of security problems, as therefore such applications are commonly very insecure, which is not only a problem for the site itself but also for others, e.g. visitors (distributing malware) or third parties (using the servers as source/amplification for attacks). Because of this it is very important to additionally learn how to implement web applications in a secure way. This paper presents a system to support such learning, based on an individual and autonomous approach. It consists of a webserver with numerous simple applications, each exemplifying a single specific class of security problems together with explanatory material for discovering such a problem and how to prevent it.