EIEIOTECHNOVATION
← Training programmes

EIEIO / AUTOMATION & EMERGING TECHNOLOGY

Advanced Web Hacking & Defense

Course outline

4 days
Discuss this programme →

Duration

4 days

Overview

This pen testing course is designed to teach you the advanced skills and techniques required to test modern web applications and next-generation technologies. The course uses a combination of lecture, real-world experiences, and hands-on exercises to teach you the techniques to test the security of tried-and-true internal enterprise web technologies, as well as cutting-edge Internet-facing applications. The final course day culminates in a Capture the Flag competition where you will apply the knowledge you acquired during the previous five days in a fun environment based on real-world technologies.

Course Objectives

  • Perform advanced Local File Include (LFI) / Remote File Include (RFI), Blind SQL injection (SQLi), and Cross-Site Scripting (XSS) combined with Cross-Site Request Forger (XSRF) discovery and exploitation
  • Exploit advanced vulnerabilities common to most backend language like Mass Assignments, Type Juggling, and Object Serialization
  • Perform JavaScript-based injection against ExpressJS, Node.js, and NoSQL
  • Understand the special testing methods for content management systems such as SharePoint and WordPress
  • Identify and exploit encryption implementations within web applications and frameworks
  • Discover XML Entity and XPath vulnerabilities in SOAP or REST web services and other datastores
  • Use tools and techniques to work with and exploit HTTP/2 and Web Sockets
  • Identify and bypass Web Application Firewalls and application filtering techniques to exploit the system

Course Outline

Advanced Attacks

  • Review of the testing methodology
  • Using Burp Suite in a web penetration test
  • Exploiting local and remote file inclusions
  • Exploring advanced discovery techniques for SQL injection and other server-based flaws
  • Exploring advanced exploitation of XSS and XSRF in a combined attack
  • Learning advanced exploitation techniques

Web Frameworks

  • Web architectures
  • Web design patterns
  • Languages and frameworks
  • Java and struts
  • PHP type juggling
  • Logic flaws
  • Attacking object serialization
  • The MEAN stack
  • Content management systems
  • SharePoint
  • WordPress

Web Cryptography

  • Identifying the cryptography used in the web application
  • Analyzing and attacking the encryption keys
  • Exploiting stream cipher IV collisions
  • Exploiting Electronic Codebook (ECB) Mode Ciphers with block shuffling
  • Exploiting Cipher Block Chaining (CBC) Mode with bit flipping
  • Vulnerabilities in PKCS#7 padding implementations

Alternative Web Interfaces

  • Intercepting traffic to web services and from mobile applications
  • Flash, Java, ActiveX, and Silverlight vulnerabilities
  • SOAP and REST web services
  • Penetration testing of web services
  • WebSocket protocol issues and vulnerabilities
  • New HTTP/2 protocol issues and penetration testing

Web Application Firewall and Filter Bypass

  • Understanding of Web Application Firewalling and filtering techniques
  • Determining the rule sets protecting the application
  • Fingerprinting the defense techniques used
  • Learning how HTML5 injections work
  • Using UNICODE, CTYPEs, and Data URIs to bypass restrictions
  • Bypassing a Web Application Firewall's best-defended vulnerabilities, XSS and SQLi

Programme scope, delivery arrangements and suitability are confirmed during enquiry.