Duration
4 days
Module 1: Web Application Architecture
1.1 Introduction
1.2 Understanding the Web Architecture
1.3 Getting familiar with web programming languages
Module 2: HTTP Basics
2.1 HTTP Request types
2.2 HTTP Status Codes
2.3 HTTP Statelessness
2.4 netcat
2.5 Curl
Module 3: Content Security Policy
3.1 Introduction
3.2 Same Origin Policy for the DOM
3.3 Same Origin Policy for the XMLHttpRequest
3.4 Same Origin Policy for Web Storage
Module 4: OWASP TOP 10 Web Vulnerabilities
4.1 Injection
4.1.1 Basic Authentication Bypass
4.1.2 Union Based SQL Injection
4.1.3 Blind SQL Injection
4.1.4 SQLMAP for the win
4.1.5 SQL Injection Defenses
4.1.6 Command Injection
4.1.7 File Uploads
4.1.8 Parameter Tampering
4.2 Session Management
4.2.1 Introduction
4.2.2 Problems with Improper Session Management
4.2.3 Weak Session IDs
4.2.4 Session Fixation attack
4.2.5 Defenses
4.3 Cross Site Scripting
4.3.1 Introduction
4.3.2 Reflected XSS
4.3.3 Stored XSS
4.3.4 DOM based XSS
4.3.5 Stealing Session Cookies
4.3.6 Running Keyloggers
4.3.7 Automated Scanners to find XSS
4.3.8 Analyzing Source for DOM XSS
4.3.9 XSS Defenses
4.3.10 Flash Security
4.4 Insecure Direct Object Reference
4.4.1 Introduction
4.4.2 Finding and exploiting Insecure Direct Object Reference
4.5 Security Misconfiguration
4.5.1 Introduction
4.5.2 Attacking Security Misconfiguration
4.5.3 File Inclusion Attacks
4.6 Sensitive Data Exposure
4.6.1 Introduction
4.6.2 Sensitive Data exposure via error messages
4.7 Missing functional level access control
4.7.1 Introduction
4.7.2 Forced Browsing
4.7.3 Dirbuster
4.8 Cross Site Request Forgery
4.8.1 Introduction
4.8.2 CSRF in GET requests
4.8.3 CSRF in POST requests
4.8.4 Identifying and exploiting CSRF
4.8.5 OWASP CSRF Tester
4.8.6 Defenses
4.9 Using components with known vulnerabilities
4.9.1 Introduction
4.9.2 Attacking vulnerable applications
4.9.3 Defenses
4.10 Unvalidated Redirects and Forwards
4.10.1 Introduction
4.10.2 Attacking Unvalidated Redirects and Forwards
Module 5: Mastering Burp Suite
5.1 Introduction
5.2 Configuring BurpSuite
5.3 Proxy
5.4 Intruder
5.5 Scanner
5.6 Repeater
5.7 Sequencer
5.8 Decoder
5.9 Comparer
Module 6: Web Application Firewalls
6.1 Introduction
6.2 Setting Up Mod Security
6.3 PHPIDS
6.4 Firewall Bypassing Techniques
6.5 Log Analysis
Module 7: HTML5 Security
7.1 Introduction
7.2 CORS
7.3 Abusing Local Storage
7.4 Defenses
Module 8: SSL Security
8.1 Introduction
8.2 Testing for weak ciphers
8.3 Recommendations
Module 9: Web service Security
9.1 Understanding Web Services
9.2 Attacking REST ful APIs
9.3 SOAPUI pro
9.4 Defenses
Module 10: XML Attacks
10.1 Introduction
10.2 XML Injection
10.3 XXE
10.4 Defenses
Programme scope, delivery arrangements and suitability are confirmed during enquiry.