AppSec for Developers (CL-ASD)

This course is ideal for Web/API developers who work day-in-day out building full-stack web applications or web APIs. Anyone who is looking to develop a skill-set into web application security and is looking to identify web application flaws will also benefit from this course.

Inclusief AI-Tutor die je tijdens en na de training ondersteunt met slimme tips, antwoorden op vragen en extra uitleg. De tool is altijd en overal beschikbaar.

APPLICATION SECURITY BASICS

• Why do we need Application Security?
• Understanding OWASP TOP 10

UNDERSTANDING THE HTTP PROTOCOL

• Understanding HTTP/HTTPS protocol
• Understanding Requests and Responses – Attack Surface
• Configure Burpsuite to intercept HTTP/HTTPS traffic

SECURITY MISCONFIGURATIONS

• Common misconfigurations in Web Applications
• Sensitive Information exposure and how to avoid it
• Using Softwares with known vulnerabilities

INSUFFICIENT LOGGING AND MONITORING

• Types of Logging
• Introduction to F-ELK

AUTHENTICATION FLAWS

• Understanding Anti-Automation Techniques
• NoSQL Security

AUTHORIZATION BYPASS TECHNIQUES

• Securing JWT and OAuth
• Local file Inclusion
• Mass Assignment Vulnerability

CROSS-SITE SCRIPTING (XSS)

• Types of XSS
• Mitigating XSS

SERVER-SIDE REQUEST FORGERY (SSRF)

• Understanding SSRF
• Mitigating SSRF

SQL INJECTION

• Error and Blind SQL Injections
• Mitigating SQL Injection
• ORM Framework: HQL Injection

XAML EXTERNAL ENTITY (XXE) ATTACKS

• Default XML Processors == XXE
• Mitigating XXE
  

UNRESTRICTED FILE UPLOADS

• Common Pitfalls around file upload
• Mitigating File upload vulnerability
  

DESERIALIZATION VULNERABILITIES

• What is Serialization?
• Identifying Deserialization functions and deserialized data
• Mitigation strategies for deserialization

CLIENT-SIDE SECURITY CONCERNS

• Understanding Same Origin Policy
• Windows Desktop ‘Breakout’ and AppLocker Bypass Techniques (Win 10)
• Client-Side Security headers and their server configurations

SOURCE CODE REVIEW

• What to check for Security in source code
• CTF: A timed game to spot the flaws in the given Source Code samples
  

DEVSECOPS

• DevSecOps – What Why and How?
• Case Study

Prior pentest/security experience is not a strict requirement, however, some knowledge of Cloud Services and familiarity with common Unix command-line syntax will be beneficial.

Delegates must bring their own laptop and have admin/root access on it. The laptop must have a virtualization software (virtualbox / VMWare) pre installed. A customized version of Kali Linux (ova format) containing custom tools, scripts and VPN scripts for the class will be provided to the students. The laptop should have at least 4 GB RAM and 20 GB of free disk space dedicated for the VM.

Not applicable