With this training, participants will understand how web applications work, their vulnerabilities and solutions to these vulnerabilities.
Who Should Participate?
IT Security Officers, Auditors, Security Professionals, Website Administrators, Web Application Developers, Information Security Professionals, System Professionals, Network Professionals, Forensic IT Professionals, Law Enforcement
Program
• HTTP Security Headers
• Transport Layer Security (TLS, SSL)
• Secure TLS Configuration
• HTTP Authentication
• Test Steps
• General Information on Types of Vulnerabilities in Web Applications
• Passive Information Collection Steps
• Active Information Gathering Steps
• Mapping the Web Application
• Browser Plugins Used for Web Application Security Testing
• Web Proxy (Burp, Zap, Fiddler, Charles)
• Automatized Tools
• Web Cache Deception
• Request Smuggling
• Server Side Template Injection
• A1-Injection
• A2-Broken Authentication
• A3-Sensitive Data Exposure
• A4-Xml External Entities (Xxe)
• A5-Broken Access Control
• A6-Security Misconfigurations
• A7-Cross Site Scripting (Xss)
• A8-Insecure Deserialization
• A9-Using Components With Known Vulnerabilities
• A10-Insufficient Logging And Monitoring