Application Security Testing Training - Online Instructor-led

Duration: 25 hours

Price: INR 17000

Course Description

Application Security training program is designed to make participants aware of common web application vulnerabilities and their impact on businesses. The course focuses on the latest hacking techniques targeted against different platforms & networks. The course also incorporates effective defence mechanisms and the use of best practices to mitigate the risk of attacks. The training expects the candidates to have basic information on HTTP and how applications work. 

Topic 1: Introduction

• Introduction and Overview
• SDLC and Security
• Shift Left Culture - Introduction
• The Importance of ASVS
• Threat Modelling
• All about Burp-suite

Topic 2: Authentication and Authorisation

• Authentication Bypass
• SSO, OAuth, OpenID, SAML, FIDO
• Access Control Flaws
• Insecure Direct Object Reference

Topic 3: Session Management Flaws

• Understanding Cookies and Session ID
• Session Management Flaws (Session Fixation, Account Takeover)
• Session ID Brute Forcing, Entropy Analysis
• CSRF, Clickjacking
• Cookie Security and headers

Topic 4: Input Validation

• Injection Flaws (SQLi, Commandi, NoSQLi)
• XSS (Reflected, Stored, DOM)
• File Upload/Download 
• Client side attacks 
• Thick clients 
• Application Fuzzing

Topic 5: Cryptography

• Symmetric, Asymmetric Encryption
• Protocol Details and versions 
• POODLE, BEAST, CRIME, BREACH, Heartbleed
• Forward Secrecy
• Padding oracle attack
• Hash Length extension attack

Topic 6: API Attacks

• SOAP and REST based attacks
• JSON, JWT Attacks
• Functional and Object Level Authorisation
• Mass Assignment

Topic 7: Advance Topics

• Web Cache Poisoning
• HTTP Request Smuggling
• HTTP Desync Attacks
• Same Origin Policy, CORS
• SSRF, Websockets
• Server-side template injection
• Insecure Deserialisation

Topic 8: Other Topics

• Code Review - Getting Started
• DevSecOps - SAST & DAST Integration
• Mobile Security - Introduction
• End-to-End Pentesting Sessions
• Reporting

Who should attend

• Application Security Testers / Ethical Hackers
• Developers / Security Code Reviewers
• Security Analysts / Professionals
• Students / Security Enthusiasts

Pre-requisites

• Basic understanding of computing 
• Know-how of web applications 
• Networking Know-how 
• Open mind
• PC/Laptop with a high-speed Internet Connection