Overview

You will learn to protect your web application by attacking it, by performing penetration testing on it. This course is rather theoretical with only some labs and demos.ObjectivesDevelop "Out-of-box" thinkingSee security from an offensive perspectiveLearn best security practices and (most and less) common attacksLearn to defend your applications and infrastructureTopicsOverview of Web Penetration TestingOWASP Top Ten Web VulnerabilitiesAPI Top Ten vulnerabilitiesHTTP Security HeadersJSON Web TokensTechnical measures and best practicesCryptographyOverview of Web Penetration TestingCore problemsWeb Technologies basicsSecurity Audit vs Vulnerability Assessment vs PentestInformation GatheringScanning and EnumerationMapping the target surfaceAttacking Users. Cross Site ScriptingAttacking the ServerAttacking AuthenticationAttacking Data StoresTop 10 API Security VulnerabilitiesAPI VulnerabilitiesExamples of vulnerabilities found in publicly accessible applicationsOWASP Top Ten Web VulnerabilitiesA1: InjectionA2 - Broken Authentication and Session ManagementA3 - Cross-Site Scripting (XSS)A4 - Insecure Direct Object ReferencesA5 - Security MisconfigurationA6 - Sensitive data ExposureA7 - Missing Function Level Access ControlA8 - Cross-Site Request Forgery (CSRF)A9 - Using Components with Known VulnerabilitiesA10 - Unvalidated Redirects and ForwardsNew Addition in OWASP TOP 10 - 2017A4 - XML External entities (XXE)A5 - Broken Access ControlA8 - Insecure DeserializationA10 - Insufficient Logging & MonitoringNew additions in 2021Common Vulnerabilities: XSS, SQL Injection, CSRF, XXE, LFIHTTP Security HeadersUnderstand HTTP Security Tokens and their roleHSTS - Strict-Transport-SecurityCSP - Content-Security-PolicyCORSX-Frame-OptionsX-XSS-ProtectionX-Content-Type-OptionsReferrer-PolicyCookie flags: HTTPOnly, SecureJSON Web TokensUnderstanding JSON WEB TOKENSToken StructureWhen can you use JWTIssuesWhat is JWT good for?Best Practices for JSON Web TokensTechnical measures and best practicesInput ValidationEncodingBind Parameters for Database QueriesProtect Data in TransitHash and Salt Your Users' PasswordsEncrypt Data at RestLogging - Best practicesAuthenticate Users SafelyProtect User SessionsAuthorize ActionsCryptographyCryptographic conceptsAlgorithmsCryptography and cryptanalysis toolsCryptography attacks

Skills

Reviews