Course Overview
This course covers a wide range of security vulnerabilities commonly found within web applications, as well as guidance on how to remediate those specific vulnerabilities and general guidance on hardening applications against attack.
We also have hands-on labs to let you test your understanding and experiment with common real-world vulnerabilities. Instead of just showing you vulnerabilities through a presentation, we give an overview of the vulnerability, demonstrate it on an example vulnerable application, then discuss strategies to address the underlying cause of the issue.
On the day, we’ll start with the OWASP Top 10 and cover basic but key vulnerabilities such as Injection and Cross-site Scripting, before moving on to more complex issues such as filter evasion and business logic issues.
The Methodology
There’s more to effective security testing and secure system development than just knowing about vulnerabilities and their exploitation – we also cover the stages of a penetration test to ensure that your approach to security testing achieves good coverage:
- Intelligence Gathering
- Application Mapping
- Vulnerability Discovery
- Exploitation and Filter Evasion
- Proof-of-Concept Development
- Privilege Escalation
Hands-on Labs
Our bespoke hands-on labs cover common vulnerabilities with a range of difficulties and filters, allowing you to ensure that you’ve understood the fundamentals of a vulnerability before moving on to more challenging examples. We have a range of labs, such as:
- Injection Vulnerabilities
- Reflected and Stored Cross-site Scripting (XSS)
- DOM-based Cross-site Scripting
- Path Traversal
- File Upload and Web Shells
Remediation
Whilst it’s often the least talked about part of security testing – remediation is of course the most important. It doesn’t matter how many vulnerabilities you find if you can’t quickly and effectively explain to the team how they can fix them. For each vulnerability discussed we will discuss a specific remediation, as well as giving examples of hardening options throughout to make applications more resilient to attacks in general.
This course is ideal for software developers looking to reinforce their foundational knowledge, stay ahead of evolving threats, and proactively secure their organisation’s web applications against attacks.