Security Testing for Engineers – SS401

This hands-on course gives software developers and quality assurance engineers the tools, processes and knowledge to test their applications against prevalent web attacks. Students will learn how attackers view their applications, how they attack these applications, the techniques to verify vulnerability scanners results, and finally, how to communicate risk to stakeholders.

Target Audience § Software Developers § Quality Assurance Engineers § Technical Leads

Course Requirements & Prerequisites § Prerequisites: Application Security Fundamentals – SS101 § Intermediate to expert understanding of the web as well as the HTTP protocol. § Intermediate to expert experience with web development technologies such as HTML, CSS, JavaScript, SQL, etc § Students are required to bring their own laptops with a minimum of 4 GB RAM installed. § VMware Workstation / Fusion / VirtualBox installed. § At least 60 GB HD free § Wired Network Support § USB 2.0/3.0 Support

Security Testing for Engineers SS-401

“This was a great class! The instructor is quite knowledgeable and makes the classes fun and informative. He is open to questions and tries to answer every one of them. Sherif is a joy!”

Keith Cooper – Elavon 2 Days Course

Security Testing for Engineers – SS401

Course Contents § Introduction § Why application security

o Client expectations o Financial cost o Brand value o Google hacking o Introducing Shodan

§ A brief of overview of HTTP Protocol o HTTP Basics o Setting up an intercepting proxy

§ Recon and information gathering o Legal and ethics consideration o Proper reconnaissance o Information gathering techniques o Open source intelligence o Port scanning techniques o Nmap o Using netcat o Spidering techniques o OWASP Zed Attack Proxy

§ Mapping and discovery o Introducing Burp Suite o Spidering with Burp o Filtering with Burp o Automating attacks using Burp o Active vs passive scanning

§ Exploitation o Blind vs Straight SQL injection o Validating Cross-site Scripting attacks o Exploiting insecure direct object reference attacks o Exploiting path manipulation attacks o Cross-site request forgery attacks

§ Conclusion and closeout remarks