Hacking Extreme Web ApplicationsHacking Extreme Web Applications

Hacking Extreme Web Applications

Instructors: cirosec consultants

Duration: 3 days

Web-based applications have become favorite targets; not only because more and more companies provide web services, online shops, banking applications, employee portals and other interactive applications with web front ends, but also because new methods are available allowing for attacking and manipulating these systems.

"Hacking Extreme Web Applications" is concerned with attacks on web applications and back-end systems.

The intensive course teaches you about the methods used by attackers, and both well-known and lesser known techniques for attacking web applications and the databases and back ends located behind them. The training takes a hands-on approach: it is characterized by numerous laboratory exercises.

A laptop with a large number of tools will be available for each participant, allowing him/her to gain practical experience with an attacker's point of view. The trainers carry out security audits on a regular basis, and they are known as experts in the application security field.

The training covers all OWASP Top Ten 2013 vulnerability types.

Main topics:

Information gathering

  • Traditional information gathering by banners, error pages, etc.
  • Webserver fingerprinting
  • Using crawlers
  • Identifying metadata information
  • Decompiling client components (Flash, Java applets, Silverlight)

Attacks on web and application servers

  • Software vulnerabilities in web and application servers (buffer overflows, etc.)
  • Exploiting misconfigurations (directory listings, etc.)
  • Application framework vulnerabilities

Attacks on the transmission

  • Eavesdropping on the communication, SSL-man-in-the-middle attacks
  • SSL vulnerabilities and misconfigurations
  • Vulnerabilities in application level encryption

Attacks on the application

  • Attacks on the authentication process
  • Attacks on stored passwords
  • Bypassing CAPTCHAs
  • Attacks on the session management
  • Cross-site scripting (persistent, non-persistent, DOM-based)
  • Cross-site request forgery (CSRF), vulnerabilities in anti-CSRF mechanisms
  • Server-Site Request Forgery (SSRF)
  • Vulnerabilities in function level access control
  • Vulnerabilities in object level access control
  • File inclusion (local/remote)
  • Open redirects
  • Command injection
  • Attacks using serialized objects
  • File upload vulnerabilities
  • Application logic vulnerabilities
  • Vulnerabilities in client-side JavaScript logic
  • Attacks on AJAX services
  • HTML5-based attack vectors
  • Web spoofing
  • CORS (cross-origin resource sharing)
  • Attacks based on third-party resources integrated in the application
  • Logging of security-relevant events to track attacks
  • Attacks facilitated by an insecure architecture

Attacks on the back end

  • SQL injection / blind SQL injection
  • LDAP injection
  • Vulnerabilities in web services
  • XML injection / XML bombs
  • XPath injection
  • XSLT injection

Systems covered:
Unix-based or Windows-based web servers, databases, application servers, etc.

Target group:
Administrators and security managers who are not afraid to see security through the attacker’s eyes, diving deeply into his world. The training is also interesting for developers and administrators of web servers and e-business systems. 

This course must definitely be considered an "advanced" training. The number of participants is limited to make sure the instruction is individual and effective.

Prerequisite:
Basic knowledge of HTTP, HTML and in the web server and database field. The exercises partly require using command-line tools on Linux. The trainers will be happy to assist in managing them in case help is needed.

Price:
€ 2,400 

This training will be held in German.

You will receive CPE Points for participating in the Hacking Extreme Web Applications training. The training takes 24 hours. You will get a certificate after having completed the training.

Dates: 
September 24-26, 2024 in Ludwigsburg 
December 10-12, 2024 in Munich

Place:
The training course will take place in fine, selected hotels:

We will gladly reserve a room for you at a special rate in the hotel where the training course takes place.

We may also gladly offer you the course in form of an in-house training.

Online registration

Your trainers

Benjamin Häublein

Simon Kömpf

Michael Brügge