BCA 316T Web Security Notes for GGSIPU BCA Semester 6 cover all 4 units in one 62-page printed book: 44 topics, 16 figures, 12 code examples, 48 two-mark answers and 35 ten-mark answer hints. They follow the BCA scheme for the batch admitted in 2024-25 onwards. Order the book on WhatsApp; it is not sold as a PDF.
Written by Prateek Talwar, Founder, Unnati Educations · Reviewed by Ritik Rawat, B.Tech, Senior Full Stack Developer · Checked against BCA Programme Common Scheme and Syllabus (w.e.f. A.S. 2024-2025), 03 Sep 2026 · Updated 13 October 2026 · Editorial policy
Scheme: BCA scheme w.e.f. A.S. 2024-25 | Applies to: batch admitted in 2024-25 onwards | Verified against: official BCA scheme and syllabus PDF, 03 Sep 2026
BCA 316T Web Security at a glance: GGSIPU BCA Sem 6 credits, units and exam pattern
| Code and title | BCA 316T Web Security |
|---|---|
| Course and semester | BCA, Semester 6 |
| Category and credits | Programme Core Elective (PCE), 4 credits, 4 lectures a week |
| Marks | 100: 40 internal + 60 end-term |
| Applies to | Batch admitted in 2024-25 onwards |
| End-term pattern | Q1: 10 compulsory short answers of 2 marks; then one 10-mark answer per unit, from a choice of two (20 + 40 = 60 marks) |
| Exam duration | 3 hours |
| Units | 4 (teaching hours 12, 11, 11 and 10) |
| Paired lab | BCA 316P Web Security Lab: 4 practical hours, 2 credits, 100 marks |
Web Security is one of four Semester 6 electives; you take one theory paper and its lab from BCA 312, 314, 316 and 318. See all GGSIPU BCA Semester 6 papers.
These GGSIPU BCA Sem 6 Web Security notes assume the listed prerequisites: Computer Network and basic C, C++, HTML or JavaScript.
BCA 316T Web Security Notes unit-wise: 44 topics, 83 exam questions and 16 figures across 4 units
The official PDF numbers units only, so the titles below are the notes' own; the sample PDF at the top has a page from each. Other papers: GGSIPU BCA notes.
BCA 316T Unit 1: Web Security Fundamentals and Social Media Security
Why the Internet's open design is weak, authentication from Basic Auth to passkeys, three-tier architecture, the OWASP Top 10 (2021), WAFs, the seven-step hacking methodology and client-side attacks, then OSN data, platform APIs and Sybil attacks.
Pages 4 to 21 · 18 sections · 6 figures · 3 code examples · 12 two-mark, 9 ten-mark.
| Models | Negative, positive or hybrid |
|---|---|
| Deployment | Network appliance, host module (ModSecurity) or cloud (AWS WAF) |
| Modes | Detection logs only; prevention blocks |
| Limits | False positives, encoding bypasses |
BCA 316T Unit 2: Internet and Web Application Security
The most code-heavy unit: PGP (sign, compress, encrypt, Radix-64) against S/MIME, login attacks, injection flaws, malware, three kinds of XSS, six SQL injection types, buffer overflows with canaries and ASLR, the Same-Origin Policy and the SET dual signature.
Pages 22 to 38 · 9 sections · 4 figures · 7 code examples · 12 two-mark, 9 ten-mark.
Quick look: the SQL injection login bypass (from page 30)
query = "SELECT * FROM users WHERE username = '" + user + "' AND password = '" + pass + "'";
user = admin' --
SELECT * FROM users WHERE username = 'admin' --' AND password = ''The -- comments out the password check; a PreparedStatement fixes it.
BCA 316T Unit 3: Wireless, Mobile Security and Cyber Forensics
Wi-Fi components, WEP to WPA3 compared, MDM and BYOD, disaster recovery with RPO and RTO, the six-step forensic process, IT Act 2000 sections 43 to 79, security audits and Zero Trust.
Pages 39 to 51 · 7 sections · 3 figures · 12 two-mark, 8 ten-mark.
| Site | Ready to run | Recovery | Cost |
|---|---|---|---|
| Hot | Yes, data mirrored live | Minutes to hours | Highest |
| Warm | Hardware ready, data restored | Hours to a day | Medium |
| Cold | Space, power, cooling only | Days to weeks | Lowest |
Quick look: disaster recovery sites (from page 43)
- Site
- Hot
- Ready to run
- Yes, data mirrored live
- Recovery
- Minutes to hours
- Cost
- Highest
- Site
- Warm
- Ready to run
- Hardware ready, data restored
- Recovery
- Hours to a day
- Cost
- Medium
- Site
- Cold
- Ready to run
- Space, power, cooling only
- Recovery
- Days to weeks
- Cost
- Lowest
BCA 316T Unit 4: Web Services, Modern Web and Security Operations
SOAP, WSDL and UDDI, SOAP vs REST, honeytokens vs honeypots, XML Signature and WS-Security, a REST checklist, CSP directives, safe deserialization, HTML5 risks like postMessage, logging pipelines, DevSecOps testing and IPv6.
Pages 52 to 62 · 10 sections · 3 figures · 2 code examples · 12 two-mark, 9 ten-mark.
| SAST | Reads source code without running it |
|---|---|
| DAST | Tests the running app from outside |
| IAST | Agent inside the app watches it during tests |
| SCA | Finds open-source libraries with known flaws |
HTTP vs HTTPS and the TLS handshake in web security: excerpt from page 6 of the BCA 316T notes
Excerpt from page 6
What HTTP is
HTTP (HyperText Transfer Protocol) is the application-layer protocol that browsers and web servers use to exchange web pages. It follows a request and response model and uses port 80. HTTP is stateless: the server does not remember earlier requests, so cookies and sessions are added to give it a memory.
What HTTPS adds
HTTPS (HTTP Secure) is plain HTTP running inside an encrypted TLS (Transport Layer Security) tunnel. TLS was earlier called SSL. HTTPS uses port 443. The padlock in the address bar shows that the site holds a valid digital certificate issued by a trusted Certificate Authority (CA).
A sample HTTP request and response
GET /login HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Cookie: sessionid=a8f3...
HTTP/1.1 200 OK
Content-Type: text/html
Set-Cookie: sessionid=a8f3...; Secure; HttpOnlyOver plain HTTP, every line above, including the session cookie, travels as readable text. Anyone on the same network path could copy that sessionid and use it. The Secure and HttpOnly flags in the response tell the browser to send the cookie only over HTTPS and to keep it away from JavaScript.
How HTTPS works: the TLS handshake, simplified
- Client Hello: the browser sends the TLS versions and cipher suites it supports, plus a random number.
- Server Hello and certificate: the server picks a cipher and sends its certificate, which carries its public key.
- Certificate verification: the browser checks the CA signature, the domain name and the expiry date.
- Key exchange: both sides agree on a shared session key using ECDHE.
- Encrypted data: all HTTP traffic is now encrypted with a fast symmetric key (AES).
Notice the split across these five steps: the server's public key is used only to set up the session, and the bulk of the traffic is then protected with the fast symmetric key. If step 3 fails, for example because the certificate has expired, the browser shows a warning instead of the padlock.
Do the BCA 316T notes cover the full GGSIPU syllabus?
Mostly. Units I and II are fully covered; Unit III lacks penetration testing and Unit IV lacks AJAX attack trends and DNS rebinding.
| Unit | Official topics | In the notes | Status |
|---|---|---|---|
| I | Internet weak points, HTTP vs HTTPS, authentication, architecture, attack trends, WAF, web hacking, attacking users; social media security, APIs, trust | Sections 1 to 18, pages 5 to 17 | Covered |
| II | PGP and SMIME, web authentication, injection, malicious code, XSS and SQL injection, memory corruption, browser and e-commerce security | Sections 1 to 9, pages 23 to 35 | Covered |
| III | Wireless and mobile security, disaster recovery, forensics, cyber laws, security audit, security solutions | Sections 1 to 7, pages 40 to 49 | Covered |
| III | Ethical hacking, penetration testing | Unit 1 hacking methodology (pages 12 to 13); no penetration testing | Partly: ethical hacking only |
| IV | Web services, honeytoken, XML, REST, CSP, serialization, HTML5, logging, security testing, IPv6 | Sections 1 to 10, pages 53 to 60 | Covered |
| IV | AJAX attack trends, clickjacking, DNS rebinding | Clickjacking: Unit 1 (page 13), CSP (page 56); no AJAX or DNS rebinding | Partly: clickjacking only |
BCA 316T official syllabus mapped to the notes
- Unit
- I
- Official topics
- Internet weak points, HTTP vs HTTPS, authentication, architecture, attack trends, WAF, web hacking, attacking users; social media security, APIs, trust
- In the notes
- Sections 1 to 18, pages 5 to 17
- Status
- Covered
- Unit
- II
- Official topics
- PGP and SMIME, web authentication, injection, malicious code, XSS and SQL injection, memory corruption, browser and e-commerce security
- In the notes
- Sections 1 to 9, pages 23 to 35
- Status
- Covered
- Unit
- III
- Official topics
- Wireless and mobile security, disaster recovery, forensics, cyber laws, security audit, security solutions
- In the notes
- Sections 1 to 7, pages 40 to 49
- Status
- Covered
- Unit
- III
- Official topics
- Ethical hacking, penetration testing
- In the notes
- Unit 1 hacking methodology (pages 12 to 13); no penetration testing
- Status
- Partly: ethical hacking only
- Unit
- IV
- Official topics
- Web services, honeytoken, XML, REST, CSP, serialization, HTML5, logging, security testing, IPv6
- In the notes
- Sections 1 to 10, pages 53 to 60
- Status
- Covered
- Unit
- IV
- Official topics
- AJAX attack trends, clickjacking, DNS rebinding
- In the notes
- Clickjacking: Unit 1 (page 13), CSP (page 56); no AJAX or DNS rebinding
- Status
- Partly: clickjacking only
Official source: BCA Programme Common Scheme and Syllabus, batch 2024-25 (ipu.ac.in) · Marks also match the BCA 4 Year Curriculum and Scheme (ipu.ac.in).
For these gaps, read TB1 and TB2; penetration testing maps to CO4. Every course in GGSIPU notes is checked against its official PDF this way.
How to write BCA 316T answers: comparison tables, attack-flow diagrams and ten-mark hint plans
The end-term gives 20 marks to ten two-mark answers and 40 to four ten-mark answers, one per unit. The notes match that split: two-mark answers run two or three lines, and every ten-mark question carries a hint naming the figure and table to use.
Two-mark answers. One-line definition, then one fact that proves you know it. For "Why is a write blocker used?" write the definition (read access, no writing) and the reason (it preserves the original evidence). Keep it short; Q1 has ten parts, and a long two-mark answer steals time from the four ten-mark answers that carry 40 marks.
Ten-mark answers. The notes' exam tips push three habits. Draw the flow: the hacking methodology, the PGP sender side or the forensic process. Use a table for every "compare" question, such as PGP vs S/MIME or WEP vs WPA3; examiners can tick a row faster than a paragraph. Add one real example, like a bank with RPO 0 and RTO 2 hours needing a hot site.
Traps the notes flag. HTTPS protects data in transit only; it does not stop SQL injection or XSS, and a phishing site can show a padlock too. In ethical hacking answers, state that testing needs written permission.
Worked example: Unit 1, Q18 (10 Marks)
"Explain the techniques of web hacking and methods of attacking users." A plan from the hint on page 20:
- Two lines: attackers profile the target first, then hit its weakest parts.
- Fig 1.5 as a seven-step flow, from profiling to attacking the client.
- A technique table: footprinting, brute force, SQL injection, path traversal, session hijacking.
- A client-side table: phishing, XSS, CSRF and clickjacking, each with one defence.
Practise this format on the GGSIPU BCA important questions for your other Semester 6 papers too.
BCA 316T exam corner: 48 two-mark answers and 35 ten-mark answer hints by unit
| Unit | 2 Marks | 10 Marks (hints) |
|---|---|---|
| 1 | 12 | 9 |
| 2 | 12 | 9 |
| 3 | 12 | 8 |
| 4 | 12 | 9 |
BCA 316T exam corner by unit
- Unit
- 1
- 2 Marks
- 12
- 10 Marks (hints)
- 9
- Unit
- 2
- 2 Marks
- 12
- 10 Marks (hints)
- 9
- Unit
- 3
- 2 Marks
- 12
- 10 Marks (hints)
- 8
- Unit
- 4
- 2 Marks
- 12
- 10 Marks (hints)
- 9
- Unit 1, 2 Marks: What is a Sybil attack? Pointer: one entity runs many fake identities to sway ratings or votes.
- Unit 2, 10 Marks: What are the threats to email? Explain the working of PGP with a neat diagram. Pointer: threat table, five PGP services, Fig 2.1, Web of Trust.
- Unit 3, 2 Marks: What is chain of custody? Pointer: a written record of who handled the evidence and when.
- Unit 4, 10 Marks: What is a honeytoken? Give examples and compare it with a honeypot. Pointer: decoy data, six examples, a comparison table, few false alarms.
The BCA 316T notes answer 48 two-mark questions and give hints for 35 ten-mark questions across 4 units.
More practice: BCA 316T important questions.
Who writes and checks the BCA 316T Web Security notes?
- Prateek Talwar, author: Founder, Unnati Educations. Associate Company Secretary (ACS), ICSI, membership no. 58704, since 15 May 2019; B.Com, University of Delhi (School of Open Learning), 2012. Profile
- Ritik Rawat, subject reviewer: Senior Full Stack Developer, Unnati Educations; B.Tech. Reviews the BCA notes, including these BCA 316T Web Security IPU notes. Profile
The 2026-27 edition is mapped to the 2024-25 batch scheme, whose third-year syllabus the Board of Studies approved on 08.08.2026. Its law content follows the IT Act 2000 (amended 2008), the DPDP Act 2023 and the Bharatiya Sakshya Adhiniyam 2023. See our editorial policy.
The same team prepares GGSIPU important questions for every course.
BCA 316T and the BCA 316P Web Security lab, plus other GGSIPU BCA Sem 6 papers
Paired lab: BCA 316P Web Security lab notes. 4 practical hours, 2 credits. Your teacher notifies the practical list in the first week.
BCA 316P shares the theory paper's course outcomes. CO5 (XSS, SQL injection, password hashing and cracking) builds on Unit 2, pages 25 to 31, where vulnerable and safe code sit side by side. CO3 (ethically hacking websites) builds on the Unit 1 methodology, pages 12 to 13.
Other elective pairs: BCA 312T Data Visualization & Analytics, BCA 314T Deep Learning with Python, BCA 318T Mobile Application Development. Core papers: BCA 302T Distributed Systems and Cloud Computing, BCA 304T Machine Learning, BCA 306T Software Project Management, with labs BCA 302P, 304P and 306P, plus BCA 320 Minor Project and BCA 374.
BCA 316T Web Security notes FAQs
How do I get the full BCA 316T notes?
Message us on WhatsApp at 9899436384 using the "Get Full Notes" button. The full BCA 316T notes come as a 62-page printed book covering all 4 units; they are not sold as a PDF. We confirm the order and delivery details there. Check the sample PDF at the top first to see the figures and tables.
Is BCA 316T compulsory in GGSIPU BCA Semester 6?
No. BCA 316T is a Programme Core Elective. The Semester 6 scheme asks you to choose one theory paper and its practical from four pairs: Data Visualization & Analytics (312), Deep Learning with Python (314), Web Security (316) and Mobile Application Development (318). Choosing Web Security means you also take BCA 316P, so the pair gives you 6 credits in total.
How many marks is BCA 316T out of, and what is the passing mark?
BCA 316T is marked out of 100: 40 internal and 60 end-term. The end-term has 20 marks of short answers and four 10-mark answers. The BCA scheme PDF prints no pass percentage for regular credit papers like this one, so we do not quote a figure. End-term minimums and re-appear rules come from GGSIPU Ordinance 11.
Which BCA 316T unit is the longest in the notes?
Unit 1, at 18 pages and 18 sections, because it joins web security basics with social media security. Unit 2 has the most code: 7 of the 12 examples, including the SQL login bypass and a C buffer overflow with its safe version. Unit 4 is the shortest at 11 pages but still has 10 sections.
Do the BCA 316T notes cover penetration testing and DNS rebinding?
Not as separate sections. The BCA 316T syllabus lists penetration testing in Unit III and AJAX attack trends and DNS rebinding in Unit IV, and the notes have no dedicated pages on these three. Ethical hacking is covered through the Unit 1 methodology, and clickjacking through Unit 1 and the CSP directives. Use the syllabus textbooks TB1 and TB2 to fill the gaps.
Which batch does this BCA 316T syllabus apply to?
Students admitted to BCA in 2024-25 onwards, the first batch on the four-year scheme. The third-year syllabus that includes BCA 316T was approved by the Board of Studies on 08.08.2026 and the Academic Council sub-committee on 19.08.2026. If you joined before 2024-25, you follow an older scheme, so check your own syllabus PDF on ipu.ac.in.
Get the full BCA 316T Web Security Notes on WhatsApp
A printed book only: 62 pages of Web Security notes in English, not available as a PDF. Delivery details are shared on WhatsApp.
Order the BCA 316T printed notes on WhatsApp (4 units, 62 pages)
Unnati Educations is an independent education provider based in Vikaspuri, Delhi. We are not affiliated with, authorised by, or endorsed by Guru Gobind Singh Indraprastha University (GGSIPU). 'GGSIPU' and 'IPU' are used only to describe the syllabus our notes follow. For official information, visit ipu.ac.in.
Ready for the full notes?
Discuss coverage and delivery with our team.