Hacking Extreme Web ApplicationsHacking Extreme Web Applications

Hacking Extreme Web Applications

Instructors: cirosec consultants

Duration: 3 days

Web-based applications have become favorite targets; not only because more and more companies provide web services, online shops, banking applications, employee portals and other interactive applications with web front ends, but also because new methods are available allowing for attacking and manipulating these systems.

"Hacking Extreme Web Applications" is concerned with attacks on web applications and back-end systems.

The intensive course teaches you about the methods used by attackers, and both well-known and lesser known techniques for attacking web applications and the databases and back ends located behind them. The training takes a hands-on approach: it is characterized by numerous laboratory exercises.

A laptop with a large number of tools will be available for each participant, allowing him/her to gain practical experience with an attacker's point of view. The trainers carry out security audits on a regular basis, and they are known as experts in the application security field.

The training covers all OWASP Top Ten 2013 vulnerability types.

Main topics:

Information gathering

  • Traditional information gathering by banners, error pages, etc.
  • Webserver fingerprinting
  • Using crawlers
  • Identifying metadata information
  • Decompiling client components (Flash, Java applets, Silverlight)

Attacks on web and application servers

  • Software vulnerabilities in web and application servers (buffer overflows, etc.)
  • Exploiting misconfigurations (directory listings, etc.)
  • Application framework vulnerabilities

Attacks on the transmission

  • Eavesdropping on the communication, SSL-man-in-the-middle attacks
  • SSL vulnerabilities and misconfigurations
  • Vulnerabilities in application level encryption

Attacks on the application

  • Attacks on the authentication process
  • Attacks on stored passwords
  • Bypassing CAPTCHAs
  • Attacks on the session management
  • Cross-site scripting (persistent, non-persistent, DOM-based)
  • Cross-site request forgery (CSRF), vulnerabilities in anti-CSRF mechanisms
  • Vulnerabilities in function level access control
  • Vulnerabilities in object level access control
  • File inclusion (local/remote)
  • Open redirects
  • Command injection
  • File upload vulnerabilities
  • Application logic vulnerabilities
  • Vulnerabilities in client-side JavaScript logic
  • Attacks on AJAX services
  • HTML5-based attack vectors
  • Web spoofing
  • CORS (cross-origin resource sharing)

Attacks on the back end

  • SQL injection / blind SQL injection
  • LDAP injection
  • Vulnerabilities in web services
  • XML injection / XML bombs
  • XPath injection
  • XSLT injection

Systems covered:
Unix-based or Windows-based web servers, databases, application servers, etc.

Target group:
Administrators and security managers who are not afraid to see security through the attacker’s eyes, diving deeply into his world. The training is also interesting for developers and administrators of web servers and e-business systems. 

This course must definitely be considered an "advanced" training. The number of participants is limited to make sure the instruction is individual and effective.

Basic knowledge of HTTP, HTML and in the web server and database field. The exercises partly require using command-line tools on Linux. The trainers will be happy to assist in managing them in case help is needed.

€ 2,400 

This training will be held in German.

You will receive CPE Points for participating in the Hacking Extreme Web Applications training. The training takes 24 hours. You will get a certificate after having completed the training.

November 10 - November 12, 2020 Hamburg
December 15 - December 17, 2020 Munich  

The training course will take place in fine, selected hotels:

We will gladly reserve a room for you at a special rate in the hotel where the training course takes place.

We may also gladly offer you the course in form of an in-house training.

Online registration

Your trainers

Michael Brügge

Benjamin Häublein

Simon Metzler

Simon Kömpf