Introduction to Penetration Testing Web Applications
This two-day course will teach you to perform security assessments of your web applications through hands-on instruction covering all of the major classes of vulnerabilities. We will be exploiting vulnerabilities in real applications. Students will be given a certificate of completion and a complementary copy of the first release of Vega Pro, the new vulnerability assessment tool for web applications developed by Subgraph.
Instructors: David Mirza Ahmad
Dates: 6-7 July 2011
Availability: 20 Seats
The high-content two-day class will begin with a quick overview of the general classes of vulnerabilities affecting web-based applications: the "OWASP Top 10" and beyond. We will illustrate using examples from real-world vulnerabilities, which affect various different web application development platforms and languages. In conclusion, we will introduce the 'tools of the trade' and present an assessment methodology that goes from information gathering to post exploitation.
We then dive into finding vulnerabilities, using real applications as our test bed: starting first with reconnaissance and exploration. Students in this class will get an intensive, hands-on plunge into securing web applications by breaking into them. We will cover many of the major classes of vulnerabilities by exploiting them, one by one. Though this is an offensive class, attention will be given to correcting and defending against these vulnerabilities.
Some of the vulnerability types covered in the course include:
* Cross-site scripting
* SQL Injection
* Command injection
* File include
* CSRF
* Session management, access control & authorization
* Crypto implementation problems
Time permitting, we will also look at web services.
We will be using open source tools, including Vega, the new web application security assessment tool developed by Subgraph. Special attention will be given to using the full power of Vega to perform in-depth penetration testing. Upon completion of this course, students can expect to have a solid base for assessing their applications. A complementary copy of Vega Pro is included with the class, along with a certificate of course completion.
Class Requirements
* Students should have a basic understanding of HTTP and the general architecture of client-server interaction.
* It is beneficial if students have a basic understanding of the typical development languages and platforms of web applications, e.g. ASP.NET, PHP, Ruby, Java
* Some pre-existing familiarity with web vulnerabilities is a plus, but not necessary.
* Familiarity with Javascript and SQL.
Hardware/software Requirements:
* Laptop running Microsoft Windows, Linux, or OS X. Detailed installation instructions to be communicated to students before the class.
Bio
David has over 10 years in the information security business. He started his professional experience as a founding member of Security Focus, which was acquired by Symantec in 2002. David also moderated the Bugtraq mailing list, a historically important forum for discussion of security vulnerabilities, for over four years. He has spoken at Black Hat, Can Sec West, AusCERT and numerous other security conferences, as well as made contributions to books, magazines and other publications. David also participated in a NIAC working group on behalf of Symantec to develop the first version of the CVSS (Common Vulnerability Scoring System) model and was an editor for IEEE Security & Privacy for several years. His current obsession is building Subgraph, his network security startup in Montreal and co-organizing the REcon ;).
To Register
To register for a training session, download and fill this file and mail it to registration.training2011 recon cx