Duration
3 days
Overview
This course provides the knowledge and skills Testers need to detect security vulnerabilities in web applications using a combination of manual and automated methods. Testing Web Application security is not intuitive and to be effective you need an understanding of web application design, HTTP, Javascript, browser behavior, and potentially other technologies such as AJAX, JSON, and XML.
Course Objectives
- Recognize common web application security vulnerabilities and how to determine if they are present in web applications
- Recognize web application design assumptions and how to exploit them
- Be familiar with the capabilities of various Browser Proxies
- Be familiar with the capabilities of various Penetration Testing tools
- Be prepared to detect Access Control Vulnerabilities
- Be prepared to detect SQL Injection Vulnerabilities
- Be prepared to detect Cross-Site Scripting (XSS) Vulnerabilities
- Be prepared to detect Authentication and Session Vulnerabilities
- Be prepared to test web application security
Prerequisites
- Application Security and the SDLC
Who Should Attend
This course is designed for those who wish to gain the skills and learn the techniques necessary to accurately and thoroughly assess the security of web applications.
Course Outline
Topic 1: Introduction
- Welcome
- Motivation
Course Overview
- The Software Development Lifecycle (SDLC)
- Security in the SDLC
- The Importance of Security Requirements
- Application Security in Context
Topic 2: A Taxonomy of Web Application Vulnerabilities
- Debug Info in Prod
- Denial of Service
- Failure to Respond to Attack
- Failure to Verify Integrity
- HTTP
- Information Leakage
- Injection
- Insecure Coding
- Insecure I/O
- Insecure Platform
- Intentional
- Poor Access Control
- Poor Certificate Management
- Poor Input Validation
- Poor Password Management
- Poor Session Management
- Race Condition
- Replay
- Sensitive Info Exposure
- Trusting DNS
Topic 3: Using a Web Proxy
- Viewing Web Page Source
- Example: Tamper Data
- Violating Designer Assumptions
- Errors vs. Unexpected Behavior
- Crafting Malicious Input
- Example: Burp Proxy
- Example: OWASP ZAP
Topic 4: Detecting XSS
- What is Cross-site Scripting?
- Example: Cross-site Scripting
- Detecting XSS Vulnerabilities
Topic 5: Detecting SQL Injection
- What is SQL Injection?
- Case Study: I Still Don’t Like Spam
- Detecting SQLi Vulnerabilities
Topic 6: Detecting Command Injection
- What is Command Injection?
- Detecting Command Injection Vulnerabilities
- Other Injection Attacks
Topic 7: Detecting Access Control Vulnerabilities
- Password Strength & Management
- Testing for Account Enumeration
- Navigate Your Way
- Testing for Client-Side Access Control
- Roles, Accounts, and Permissions
- Testing for Cross-site Request Forgery
- Testing for Path Traversal
- Testing for Horizontal Escalation
- Testing for Replay
- Testing for Session Fixation
- Testing for Session Termination
Topic 8: Detecting Other Vulnerabilities
- Parameter Mayhem
- Sensitive Information Exposure
- Event Timing
- File Uploads and Transfers
- Testing for Denial of Service
Topic 9: Miscellaneous Topics
- Application Security in Perspective
- Security Manager Design Pattern
- Avoiding Common Vulnerabilities
- Security in the SDLC
- The Security Design Review
- The OWASP ESAPI
Programme scope, delivery arrangements and suitability are confirmed during enquiry.