Duration
1 day
Overview
This course covers web technology, including protocols, languages, clients, and server architectures, from the attacker's perspective. The participants will also be introduced to hacking lifecycle (reconnaissance, network scanning, gaining access, maintaining access and covering tracks).
This course will also review the fundamental principles of each phase and discuss how penetration testers can use them together as a cyclical in-depth attack process. We then cover the types of penetration testing and what pieces need to be part of a thorough, high-value penetration testing report.
Prerequisites
- Basic knowledge of network, internet and protocols
- Basic knowledge of Linux command line
- Basic knowledge of computer usage
Module 1: Introduction
- Overview of the web from a penetration tester's perspective
- Exploring the various servers and clients
- Discussion of the various web architectures
- Discovering how session state works
- Discussion of the different types of vulnerabilities
- The HTTP protocols
- WebSocket
- Secure Sockets Layer (SSL) configurations and weaknesses
- Utilizing the Burp Suite in web app penetration testing
- OWASP Testing Methodology
- OWASP Top 10 Vulnerabilities
- Hacking Lifecycle
Module 2: Information Gathering and Scanning
- Google hacking
- Other techniques for information gathering
- Scanning with Nmap
- Discovering the infrastructure within the application
- Identifying the machines and operating systems
- Learning tools to spider a website
- Brute forcing files and directories
- Fuzzing
- Scanning for vulnerabilities
Module 3: Web Authentication – Password Cracking
- Web authentication
- Password cracking techniques
- Tools for password cracking
- Username harvesting and password guessing
Module 4: Injection
- Introduction to SQL Injection
Module 5: Penetration Testing Report Writing
- Report basics
- Report format
- Taking screenshot for the report
- Sample report
Programme scope, delivery arrangements and suitability are confirmed during enquiry.