Web Application Security Training

Introduction

Today most of the applications are web based including applications providing access to the corporate information which may be public or confidential. Organizations have invested a lot on protecting their infrastructure but now the attackers have turned attention over the web application for which the traditional protection mechanisms are not sufficient. The number of web application attacks is increasing every day and so are the business processes moving increasingly towards web services.

This training brings awareness of common web application vulnerabilities and the impact they have on your business. You will also learn effective defense mechanisms and security best practices to counter the web application attacks

Duration

3 Days

Who Should Attend

Anyone responsible for securing the infrastructure, penetration testers, security analysts, developers and anyone interested in understanding the web application concerns

Prerequisites

Familiarity with web technologies and information security

What Will You Learn

1. Identify and understand areas of risk in web applications
2. Assessing existing web applications
3. Reduce vulnerabilities and extra development cycles for security fixes - Security professionals gain valuable insight to application layer security
4. Increasing Application Security Awareness for Managers and Developers
5. Protecting Revenue and Reputation of the organization

Contents

1. Introduction to Web Technologies
2. Authentication and Application Access Control
3. Broken Account and Session Management
4. Web Certificates and Secure Socket Layer
5. General Input Validation
6. Unicode Exploits
7. Introduction to SQL Injection, Attack Samples and Database Structure
8. Detecting SQL Injection
9. Blind SQL Injection
10. SQL Injection Mitigation and Vulnerability Testing
11. Cross Site Scripting (XSS)
12. Buffer Overflows
13. Command Injection Flaws
14. Denial of Service
15. Web and Application Server Misconfiguration
16. Web Services Attack Patterns
17. Web Application Security Assessment
18. Web Application Firewalls and IPS
19. Web Server Modules

Hands-on

Live demonstrations and concept examples using the following:

1. Webgoat
2. Hackme bank
3. Metasploit
4. Webinspect
5. Modsecurity
6. IIS lockdown
7. Nikkto