This course aims to teach learners about the OWASP top 10 in bite size modules, we will look at the OWASP top 10 vulnerabilities and mitigations available to any development environment. We can also teach this course over a shorter period as a [...]
  • QAOWASPF-QA
  • Cena na vyžádání

This course aims to teach learners about the OWASP top 10 in bite size modules, we will look at the OWASP top 10 vulnerabilities and mitigations available to any development environment. We can also teach this course over a shorter period as a facilitated 4hr workshop, focused on the specific topics of interest.It is important to understand that this is the baseline set of security standards. Remembering that this knowledge can be reused across technology stacks.Broken Access ControlsCryptographic FailuresInjectionInsecure DesignSecurity MisconfigurationVulnerable and Outdated ComponentsIdentification and Authentication FailuresSoftware and Data Integrity FailuresSecurity Logging and Monitoring FailuresServer-Side Request Forgery (SSRF)The learner will have six months access to application security practice labs;1. Web Application Security Analysis using OWASP-ZAPStudents will use the OWASP program’s ZAP tool suite from within Kali Linux to scan multiple web services and document vulnerabilities. Students will see ZAP in action on a vulnerable web site where entire database tables are available to potential attackers.2. Web Application Security Analysis using NiktoStudents will use the Nikto tool to test web services over the network and document vulnerabilities. Students will then use network packet capture tools such as Wireshark to verify their understanding of the vulnerabilities and testing procedures.3. Web Application Security Analysis using VegaStudents will use the Vega scanning tool, within a graphical Kali Linux environment, to test web services over the network and document vulnerabilities. Students will then use network packet capture tools such as Wireshark to verify their understanding of the vulnerabilities and testing procedures.4. Web Application Security Analysis using Burp SuiteBurp Suite is an industry standard suite of tools used by information security professionals for testing Web application security. Its tools work together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security vulnerabilities.5. Detecting and Exploiting SQL Injection VulnerabilitiesStudents will learn how to detect and exploit SQL injection vulnerabilities. By using several SQL injections techniques students will gather information about a remote database such as Operating System, database type, table names and their content. Students will then use sqlmap, a tool for SQL injection, to automate this process.6. Web Site ReconnaissanceWeb site reconnaissance is about gathering information about a web site. Of course, there is information published on the website that is intended for people to see. Then there is information such as the name and version of the software used in the website and information about databases used by web applications on the site. This is information the website owner may not want known but can be discovered using techniques covered by CYRIN labs in the Network Monitoring and Recon and Web Application Security Analysis categories.

  • Identify the OWASP Top 10 Vulnerabilities
  • Explain how these vulnerabilities could be exploited
  • Outline potential impact and consequences of web-based attacks
  • Describe baseline mitigation steps and techniques to prevent common web and application-based attacks

Mám zájem o vybraný QA kurz