Web Application Security Testing

Day - 1

Web application security testing methodology

Web server functionalities

Different protocols introduction

Lab setup

Day - 2

Http protocol introduction

Defining methods

Practical on http verb tampering issue

Net cat, burp suite

Day - 3

Http encoding methods and status codes

Difference between http and https protocols

Day - 4

Information gathering

Day - 5

Mapping techniques

Day - 6

Introduction to OWASP top 10 list

Security misconfiguration

Sensitive data exposure

Day - 7

Injection

Command injection (attack) and code analysis

HTML injection (attack) and code analysis

XML injection (attack)

Php code injection(attack)

Day - 8

SQL injection (attack)

Basic SQL injection

Day - 9

SQL injection (attack)

Union SQL injection

SQL map tool

Day - 10

LFI and RFI

File uploading vulnerability

Insecure Direct object reference

Day - 11

Cross site scripting (XSS)

Reflective and stored

Day - 12

Cross site scripting (XSS)

DOM based

Code analysis

Day - 13

Broken authentication and session management 1

Day - 14

Broken authentication and session management 2

Day - 15

Missing functional access control

CSRF

Day - 16

Unvalidated redirects and forwards

Using components with known vulnerabilities

Day - 17

Reporting

Day - 18

Revising all the attacks so far covered

Day - 19

Advanced attacks 1

Day - 20

Advanced attacks 2

Day - 21

Advanced attacks 3

Day - 22

Code review techniques in php

Day - 23

Conclusion and Road map