Online Application Security Testing Essential Training
Overview
Embed security into the software development life cycle. Discover how to use online security testing to validate your code and uncover vulnerabilities.
Building security testing into the software development life cycle is the best way to protect your app and your end users. This course identifies tools and techniques that developers can use to minimize the cost and impact of security testing—while maximizing its impact and effectiveness. In this course, instructor Jerod Brennen focuses on online testing, using security scanning, penetration testing, and vulnerability testing to validate code and uncover vulnerabilities. He explains the difference between positive and negative, manual and automated, and production and nonproduction testing, so you can choose the right kind for your workflow. The hands-on sections—with demos of popular tools such as Fiddler, Burp Suite, and OWASP OWTF—prepare you to apply the lessons in the real world.
Building security testing into the software development life cycle is the best way to protect your app and your end users. This course identifies tools and techniques that developers can use to minimize the cost and impact of security testing—while maximizing its impact and effectiveness. In this course, instructor Jerod Brennen focuses on online testing, using security scanning, penetration testing, and vulnerability testing to validate code and uncover vulnerabilities. He explains the difference between positive and negative, manual and automated, and production and nonproduction testing, so you can choose the right kind for your workflow. The hands-on sections—with demos of popular tools such as Fiddler, Burp Suite, and OWASP OWTF—prepare you to apply the lessons in the real world.
Syllabus
Introduction
- The importance of online testing
- What you should know
- Software quality assurance process
- Positive testing
- Negative testing
- SQA metrics
- OWASP Testing Guide
- Demo: OWASP ZAP
- Manual vs. automated testing
- Scanning vs. pen testing
- Testing in non-production
- Testing in production
- OSINT gathering
- Web app proxies
- Demo: Fiddler2
- Demo: Burp Suite
- Demo: Samurai Web Testing Framework (WTF)
- Scoping a web app pen test
- Avoiding production impacts
- The penetration testing execution standard
- Types of pen tests
- Web application firewalls
- SIEMs
- Purple teaming
- Demo: OWASP OWTF
- The OWASP Top Ten
- A1: Injection
- A2: Broken authentication
- A3: Sensitive data exposure
- A4: XML external entities (XXE)
- A5: Broken access control
- A6: Security misconfiguration
- A7: Cross-site scripting (XSS)
- A8: Insecure deserialization
- A9: Using components with known vulnerabilities
- A10: Insufficient logging and monitoring
- Next steps
Taught by
Jerod Brennen
Related Courses
-
Offline Application Security Testing Essential Training
-
Learning the OWASP Top 10
-
Cloud Application Security
University of Minnesota
-
Penetration Testing Essential Training
-
Proactive Computer Security
University of Colorado System
5.0 -
OWASP Top 10: #5 Broken Access Control and #6 Security Misconfiguration
Reviews
0.0 rating, based on 0 reviews