Duration
3 days
Overview
Web applications are listed in the top ten security issues for years. Web application assessment plays an important role to secure web applications from attacks. This course covers web applications security and its technologies.
The course will examine web architectures from penetration tester perspective. Participants will learn to start actual process of penetration testing, starting with the reconnaissance and mapping phases and end by vulnerabilities discovery and exploitation.
Then, participants will identify and discuss ten (10) common web application vulnerabilities and recommendations as well as related mitigations and testing strategies that include secure coding methods. This course concludes by launching actual exploits against ten (10) common web application vulnerabilities found on testing applications. Participants are able to explore multiple exploit attacks.
Objectives
- Understand the essentials topics underlying web applications;
- Understand and learn the vulnerabilities and threats faced;
- Identify methods of exploiting these vulnerabilities;
- Identify methods of protecting and mitigating these threats and attacks;
- Identify secure coding practices to address these weaknesses;
- Secure the web server in the organization infrastructure
Target Participants
- Management, Administrator, IT Security personnel who are in charged of security in their organizations
- Also applicable to individual who wants to learn about web application security and experience some hands-on penetration testing exercises
- This training requires some experience and this is not a programming class
Day 1: Principles of Web Application Security Assessment
- Web Application Basic
- Web Application Security Assessment Methodology
- Reconnaissance & Mapping
- Vulnerabilities Discovery
- Exploitation
Day 2: Common Threats and Defend
- SQL Injection & Blind SQL Injection
- Cross Site Scripting (XSS)
- Information Leakage and Improper Error Handling
- Sensitive Data Exposure
- Cross Site Request Forgery
- Failure to Restrict URL Access
- Remote File Include (RFI)
- Broken Authentication & Session Management
Day 3: Web Application Cyber Attacks
- SQL Injection & Blind SQL Injection
- Cross Site Scripting (XSS)
- Information Leakage and Improper Error Handling
- Sensitive Data Exposure
- Cross Site Request Forgery
- Failure to Restrict URL Access
- Remote File Include (RFI)
- Broken Authentication & Session Management
Programme scope, delivery arrangements and suitability are confirmed during enquiry.