UUY-CYB 2222 units200 LevelSecond Semester

Web and Mobile Applications Security

B.Sc. Cybersecurity, University of Uyo

UUY-CYB 222 (Web and Mobile Applications Security) is a 2-unit, 200 Level course taught in the Second Semester at the University of Uyo, Akwa Ibom State, Nigeria.

Attacking and defending web and mobile applications. Covers the OWASP Top 10 in depth, secure coding practices for Java/Python/Kotlin/Swift, audit and QA testing, and mobile-specific threats on iOS and Android platforms.

On Areté, UUY-CYB 222 comes with

  • 13 lecture-note topics
  • 81 practice questions
  • 62 past-paper questions
  • 2 recommended textbooks
  • an AI tutor that has read this course’s outline and notes
Sign in to study UUY-CYB 222

Free for University of Uyo students — sign in with your email, no password.

Course outline

  1. 01The impact of the internet and web applications on the business world
  2. 02Principles and strategies for the design and implementation of secure applications — writing software that makes it difficult for intruders to exploit security loopholes in applications/code
  3. 03Secure program development for mobile (Android, iOS) and web
  4. 04Delineation of web-based risks, common website attacks, weaknesses, and security best practices
  5. 05Value and importance of vulnerability and security assessment for web and mobile applications
  6. 06Attributes and qualities of secure coding practices
  7. 07Role and importance of audit compliance and quality assurance testing for web/mobile applications
  8. 08Next-generation challenges in securing web/mobile applications and data
  9. 09Lifecycle approach to web/mobile application security

What the UUY-CYB 222 lecture notes cover

  1. 01Foundations: Web & Mobile Applications
  2. 02Impact of the Internet & Web Applications on Business
  3. 03Principles & Strategies for Secure Design
  4. 04Mobile Threats & Secure Development Practices
  5. 05Mobile Platform Security Models — iOS vs Android
  6. 06Mobile Bearer Layers — WAP, Bluetooth, SMS/MMS & Location
  7. 07Risks & Threats
  8. 08Website Attacks
  9. 09Strengths, Weaknesses & Best Practice
  10. 10Audit, Compliance & Quality Assurance
  11. 11Web Application Security & the Security Lifecycle
  12. 12The OWASP Top 10 — Ranking Web Application Risk
  13. 13Exam Focus — The Lecturer’s Guaranteed Questions

13 transcribed topics, taken from the lecturer’s own workbook. Readable in full once you sign in.

UUY-CYB 222 key concepts

Web Application
A web application is software controlled by a centralized server and accessed through browsers with an internet connection. Web apps use a combination of server-side (e.g. PHP, ASP.NET) and client-side (HTML, CSS) scripts to process and present data to the user.
Mobile Application
A mobile application is software installed directly on a user’s device (iOS or Android), designed to run on a mobile device or tablet. Some mobile apps can also be accessed via an internet connection and a web browser.
E-commerce
E-commerce refers to markets enabled by the internet — the buying and selling of goods and services online.
Teleconferencing & Remote Collaboration
Teleconferencing is the use of digital technology to communicate between businesses or individuals located in different geographical areas.
Audio Conferencing
communication by voice only, with no video — e.g. a conference phone call
Video Conferencing
participants see and hear each other in real time — e.g. Zoom or Google Meet
Web Conferencing
online meetings that add shared screens, slides and documents to the call
Hybrid Conferencing
combines in-person and remote participants in the same meeting
Marketing, Advertising & Customer Engagement
The internet lets businesses reach and engage customers directly, and much of it is powered by tracking. When a cookie is dropped on a platform, it records that a person searched for a particular item — which lets the business show that person targeted adverts later.
Supply Chain & Logistics
Logistics and supply chain management benefit significantly from internet connectivity and web applications, which coordinate the flow of goods, information and resources.
Recreational / “for fun”
curiosity or a technical challenge, without intent to cause damage
Fame
the desire for recognition within a hacking community
Activism (“hacktivism”)
pursuing a political, social, or ideological cause
Financial gain
the most common driver of serious cybercrime — fraud, extortion, data resale
Coercion
an individual is forced or blackmailed into compromising a system
Destruction
intent to disrupt, delete, or disable systems and data
Espionage
gathering confidential information for competitive, corporate, or state advantage
Hobbyists
informal, curiosity-driven individuals, often with limited resources
Government & law-enforcement agencies
acting under legal authority, though their tools and techniques mirror those of attackers
Activists
acting in pursuit of a cause rather than personal gain
Cyberterrorists
seeking to cause fear, disruption, or harm at scale
Criminal actors
organized groups pursuing financial gain
Insiders
employees or contractors who already hold legitimate access, making them uniquely positioned to cause damage
AI-augmented hackers
an emerging category using automated and AI-assisted tools to scale reconnaissance and attacks
Authentication vs Authorization
Authentication is the process of verifying the identity of a user, device, or service before granting access to protected digital resources. Authorization is the process of giving a verified user permission to access a physical location or digital information.
Password Security & Creation
Password policy is the most basic layer of access control, and it should be enforced at the point a user or account is created, not applied after the fact.
Two-Factor Authentication (2FA)
2FA adds a second, independently generated credential on top of the known password. During registration the system collects an alternative contact point — typically a phone number or email address — and at login it sends a one-time code (commonly 4–8 digits) to that channel.
Three-Factor Authentication (3FA)
3FA requires evidence from three independent categories of proof, not merely three steps or three devices. The three factors are: something you know — a password, PIN or passphrase; something you have — a phone, hardware token or smart card; and something you are — a fingerprint, face or iris.

The 13 topics define many more terms than these — the full set, with flashcards, is in the notes.

Read the start of “Foundations: Web & Mobile Applications”

Introduction

The web is a collection of documents. The system stores web pages, images, videos, and other resources on a server, all connected through hyperlinks.

Key Topics Covered

  • Web app risk
  • Distinguishing between web apps and mobile apps
  • Comparison between web risk and mobile app risk
  • Website attacks, strengths & weaknesses
  • Best practices for defense

Web Application

A web application is software controlled by a centralized server and accessed through browsers with an internet connection. Web apps use a combination of server-side (e.g. PHP, ASP.NET) and client-side (HTML, CSS) scripts to process and present data to the user. Server-side scripts manage the storage and retrieval of data, ensuring web app functions are handled correctly. Web apps support various protocols, such as HTTP (Hypertext Transfer Protocol).

  • PHP and ASP.NET are server-side languages — they run on the web server, not in the user’s browser, and are responsible for things like talking to a database or processing a login.
  • HTML and CSS are client-side — they run in the browser itself and control what the page looks like.
  • Because web apps depend on a central server, anyone who compromises that server can potentially affect every single user — the core reason web risk is described as “centralized” later in these notes.

How a Web Application Works

A web application functions using a combination of server-side and client-side scripts. Server-side scripts, written in languages like PHP or ASP.NET, manage the storage and retrieval of data, ensuring the application’s core functions are executed on the server. Client-side scripts — typically HTML, CSS and JavaScript — handle the presentation of that information and build the user interface. When a user interacts with a web application, their browser sends a request to the server; the server processes it and returns the necessary data; the browser then uses client-side scripts to display that data in a readable, interactive format. This request–response cycle is what allows a web application to serve dynamic content.

Features of Web Applications

  • Presentation of information to users
  • Built using the best available web technology, without direct access to device functionality
  • Support for a variety of protocols — for example HTTP (Hypertext Transfer Protocol)

That is the opening of topic 1 of 13. Sign in — free, no password — to read the rest, take the practice questions, and ask the AI tutor about any of it.

Read all 13 UUY-CYB 222 topics

Recommended textbooks

  • The Web Application Hacker's Handbook — Stuttard & Pinto

    2nd ed. — the definitive reference; highly detailed

  • Real-World Bug Hunting — Peter Yaworski

    Practical case studies of real vulnerabilities; very engaging

How to pass UUY-CYB 222

  • PortSwigger Web Security Academy is free and has labs for every OWASP Top 10 vulnerability — essential
  • DVWA (Damn Vulnerable Web Application) is a free practice target you can run locally
  • For every vulnerability, know: how it works, how to exploit it, and how to fix it
  • Bug bounty write-ups on HackerOne and Bugcrowd are the best real-world case studies

UUY-CYB 222 — questions and answers

What is UUY-CYB 222 at the University of Uyo?
UUY-CYB 222 (Web and Mobile Applications Security) is a 2-unit, 200 Level course taught in the Second Semester at the University of Uyo, Akwa Ibom State, Nigeria. Attacking and defending web and mobile applications. Covers the OWASP Top 10 in depth, secure coding practices for Java/Python/Kotlin/Swift, audit and QA testing, and mobile-specific threats on iOS and Android platforms.
What topics are covered in UUY-CYB 222?
The UUY-CYB 222 outline covers 9 topics: The impact of the internet and web applications on the business world; Principles and strategies for the design and implementation of secure applications — writing software that makes it difficult for intruders to exploit security loopholes in applications/code; Secure program development for mobile (Android, iOS) and web; Delineation of web-based risks, common website attacks, weaknesses, and security best practices; Value and importance of vulnerability and security assessment for web and mobile applications; Attributes and qualities of secure coding practices; Role and importance of audit compliance and quality assurance testing for web/mobile applications; Next-generation challenges in securing web/mobile applications and data; Lifecycle approach to web/mobile application security.
What textbooks are recommended for UUY-CYB 222?
Recommended reading for UUY-CYB 222: The Web Application Hacker's Handbook by Stuttard & Pinto; Real-World Bug Hunting by Peter Yaworski.
How do I pass UUY-CYB 222?
PortSwigger Web Security Academy is free and has labs for every OWASP Top 10 vulnerability — essential DVWA (Damn Vulnerable Web Application) is a free practice target you can run locally For every vulnerability, know: how it works, how to exploit it, and how to fix it Bug bounty write-ups on HackerOne and Bugcrowd are the best real-world case studies
Where can I find UUY-CYB 222 lecture notes and past questions?
Areté (https://www.aretecyb.tech/courses/uuy-cyb-222) carries 13 lecture-note topics, 81 practice questions, 62 past-paper questions, 2 recommended textbooks for UUY-CYB 222, plus an AI tutor that has read the outline. It is free for University of Uyo students — sign in with your email, no password.

Other 200 Level courses

Lecture notes, practice questions and the AI tutor for UUY-CYB 222 are available once you sign in.

Sign in to Areté