Web Application Penetration Testing

Web Application Penetration Testing Training is designed to teach the details of web app penetration testing in an immersive environment. Our trainers are experts of the industry and they will teach you Web application analysis, information gathering and enumeration to add to your skill. Our Web Application Penetration Testing course will let you have a hands-on penetration testing experience in our cloud-hosted lab environment.You will be provided with an app demonstrating a vulnerability commonly found in a Web or mobile app.

Course Objectives

Web Application Assessment

• OWASP Top 10 Vulnerabilities
• Threat Modelling Principle
• Site Mapping & Web Crawling
• Server & Application Fingerprinting
• Identifying the entry points
• Page enumeration and brute forcing
• Looking for leftovers and backup files

Authentication vulnerabilities

• Authentication scenarios
• User enumeration
• Guessing passwords – Brute force & Dictionary attacks
• Default users/passwords
• Weak password policy
• Direct page requests
• Parameter modification
• Password flaws
• Locking out users
• Lack of SSL at login pages
• Bypassing weak CAPTCHA mechanisms
• Login without SSL

Authorization vulnerabilities

• Role-based access control (RBAC)
• Authorization bypassing
• Forceful browsing
• Client-side validation attacks
• Insecure direct object reference