Instructors: cirosec consultants
Duration: 3 days
Web-based applications have become favorite targets; not only because more and more companies provide web services, online shops, banking applications, employee portals and other interactive applications with web front ends, but also because new methods are available allowing for attacking and manipulating these systems.
"Hacking Extreme Web Applications" is concerned with attacks on web applications and back-end systems.
The intensive course teaches you about the methods used by attackers, and both well-known and lesser known techniques for attacking web applications and the databases and back ends located behind them. The training takes a hands-on approach: it is characterized by numerous laboratory exercises.
A laptop with a large number of tools will be available for each participant, allowing him/her to gain practical experience with an attacker's point of view. The trainers carry out security audits on a regular basis, and they are known as experts in the application security field.
The training covers all OWASP Top Ten 2013 vulnerability types.
- Traditional information gathering by banners, error pages, etc.
- Webserver fingerprinting
- Using crawlers
- Identifying metadata information
- Decompiling client components (Flash, Java applets, Silverlight)
Attacks on web and application servers
- Software vulnerabilities in web and application servers (buffer overflows, etc.)
- Exploiting misconfigurations (directory listings, etc.)
- Application framework vulnerabilities
Attacks on the transmission
- Eavesdropping on the communication, SSL-man-in-the-middle attacks
- SSL vulnerabilities and misconfigurations
- Vulnerabilities in application level encryption
Attacks on the application
- Attacks on the authentication process
- Attacks on stored passwords
- Bypassing CAPTCHAs
- Attacks on the session management
- Cross-site scripting (persistent, non-persistent, DOM-based)
- Cross-site request forgery (CSRF), vulnerabilities in anti-CSRF mechanisms
- Vulnerabilities in function level access control
- Vulnerabilities in object level access control
- File inclusion (local/remote)
- Open redirects
- Command injection
- File upload vulnerabilities
- Application logic vulnerabilities
- Attacks on AJAX services
- HTML5-based attack vectors
- Web spoofing
- CORS (cross-origin resource sharing)
Attacks on the back end
- SQL injection / blind SQL injection
- LDAP injection
- Vulnerabilities in web services
- XML injection / XML bombs
- XPath injection
- XSLT injection
Unix-based or Windows-based web servers, databases, application servers, etc.
Administrators and security managers who are not afraid to see security through the attacker’s eyes, diving deeply into his world. The training is also interesting for developers and administrators of web servers and e-business systems.
This course must definitely be considered an "advanced" training. The number of participants is limited to make sure the instruction is individual and effective.
Basic knowledge of HTTP, HTML and in the web server and database field. The exercises partly require using command-line tools on Linux. The trainers will be happy to assist in managing them in case help is needed.
You will receive CPE Points for participating in the Hacking Extreme Web Applications training. The training takes 24 hours. You will get a certificate after having completed the training.
July 16 - July 18, 2019 Ludwigsburg
November 12 - November 14, 2019 Hamburg
December 17 - December 19, 2019 Munich
The training course will take place in fine, selected hotels:
- Hamburg: Mövenpick Hotel Hamburg
- Cologne: art'otel Cologne
- Munich: Steigenberger Hotel München
- Stuttgart: nestor Hotel Ludwigsburg
We will gladly reserve a room for you at a special rate in the hotel where the training course takes place.
We may also gladly offer you the course in form of an in-house training.