Virtual Open-Source Labs for Web Security Education

Web security education depends heavily on hands-on labs that guide the students in developing web applications, evaluating the effectiveness of available security mechanisms, and detecting the security flaws of existing web applications. Since a typical web application runs on multiple servers including web servers, application servers and database servers, it has been a great challenge in supporting them in university laboratories. This paper introduces some of our virtual web security labs developed as part of our NSF SWEET (Secure WEb dEvelopment Teaching) and Department of Defense Information Assurance Scholarship projects. All of these labs are developed on our open-source Ubuntu virtual machines, and all servers and applications are open-source thus are freely available. Course modules have been developed to use these open-source virtual labs to study cryptography, HTTP and HTTPS protocols, and introduction to Java web technologies. All of these resources are freely available to the public.