What you'll learn:
- Understand and perform the basic steps in order to performa penetration testing of a web application
- Understand web application's security principles and potential dangers
- Be able to gather information about your target
- You will learn how to find vulnerabilities in your target web application
- Exploit found vulnerabilities and get control over remote servers
- Understand the penetration testing process
- As a web application developer you will understand how to secure your application
In order to protect yourself from hackers, you must think as one.
This training is based on a practical approach of day-by-day situations and it contain labs based on real environments.
In this course, you will start as abeginnerwith no previous knowledge about penetration testing orhacking.
This course is focused on thepractical side ofpenetrationtesting without neglecting the theory behind each attack. Before jumping into penetration testing, youwill first learn how toset up a lab and install needed softwareto practice penetration testing on your own machine.
The course objective is to help you learn to master the (ethical) hacking techniques and methodology that are used in penetration systems. The course is designed for IT passionate, network and system engineers, security officers.
Once you understand how websites work we will start talking about how can weexploit these components. This course will take youfrom a beginner to a more advanced level --so you will beable to launch attacks and test the security of websites and web applications, and furthermore you'll be able to help fixing these vulnerabilitiesandsecure websitesfrom them.
Below are the main topics, both theoretical and practical, of this course:
Core problems (Causes. Defences)
Web Technologies (HTTP Protocol, Web Functionality, Encoding)
Mapping (Spidering and Analysing)
Attacking Authentication (Technologies, Flaws, Fixes, Brute Force)
Attacking Session Management (State, Tokens, Flaws)
Attacking Access Controls (Common Vulnerabilities, Attacks)
Attacking Data Stores (SQL Injection, Bypassing Filters, Escalation)
Bypassing Client-Side Controls (Browser Interception, HTML interception, Fixes)
Attacking the server (OS command Injection, Path Traversal, Mail Injection, File Upload)
Attacking Application Logic
Cross Site Scripting
Attacking Users (CSRF, ClickJacking, HTML Injection)
OWASPTop Ten Vulnerabilities
Network Attacks
Labs:
Spidering, Website Analyser
Brute-Force
Session Hijacking via Mann-in-The-Middle
Get Gmail or Facebook Passwords via SSLStrip
SQL Injection
Upload File and Remote Execution
Cross-Site Scripting (Stored + Reflected, Cookie Stealing, Preventing XSS)
CSRF (Change password trough CSRF vuln., Preventing CSRF)
NOTE: This course is created only for educational purposes andall the attacks are launched in an isolated lab environment.
