Best Web Application Penetration Testing Course in Pune|Web Application Penetration Security Training in Pune

About Web Application Penetration Secuirty Training

Web Application Penetration Testing Course Syllabus

Penetration Testing Process

1. Introduction (Pre-engagement)
   1. Rules of Engagement
   2. Goal
   3. Scope of engagement
   4. Timetable
   5. Liabilities and Responsibilities
   6. Non-disclosure agreements
   7. Emergency Plan
   8. Allowed Techniques
   9. Deliverables
2. Methodologies
   1. PTES
   2. OWASP Testing Guide
3. Reporting
   1. What do clients want?
   2. Writing the report
   3. Reporting Phase
   4. Understanding your audience
   5. Report
   • Structure Executive
   • Summary Risk Exposure
   • over time
   • Successful attacks by type
   • Vulnerabilities by cause
   • Vulnerability Report
   • Remediation Report
   6. Report templates and guides

Introduction to Web Applications

4. HTTP/S Protocol Basics
   1. HTTP Request
   2. HTTP Response
   3. HTTP Header Field Definitions
   4. HTTPS
5. Encoding
   1. Introduction
   2. Charset
   3. ASCII
   4. Unicode
   5. Charset vs. Charset Encoding
   6. Unicode Encoding
   7. Encoding HTML Entries
   8. URL Encoding (percent encoding)
   9. Base64
6. Same Origin
   1. Origin definition
   2. What does SOP protect from?
   3. How SOP works
   4. Exceptions
   5. Windows.location
   6. Document.domain
   7. Cross window messaging
   8. Cross Origin Resource Sharing
7. Cookies
   1. Cookies Domain
   2. Specified cookie domain
   3. Specified cookie domain
   4. Internet Explorer Exception
   5. Inspecting the Cookie Protocol
   6. Login
   7. Set-Cookie
   8. Cookie
   9. Cookie Installation
   10. Correct cookie installation
   11. Incorrect cookie installation
8. Sessions
9. Web Application Proxies
   1. Burp Suite
   2. OWASP ZAP

Information Gathering

10. Gathering information on your target
    1. Finding owner, IP, and emails
    2. Whois Command line Web-based tool
    3. DNS
    4. Nslookup Find target ISP Netcraft
11. Infrastructure
    1. Fingerprinting the web server
    2. Netcat
    3. WhatWeb
    4. Wappalyzer
    5. Web server modules
    6. Enumerating subdomains
    7. Netcraft
    8. Google
    9. Subbrute
    10. Dnsrecon
    11. TheHarvester
    12. Zone transfer
    13. Finding virtual hosts
12. Fingerprinting frameworks and applications
    1. Third party add-ons
    2. Mapping results
13. Fingerprinting custom applications
    1. Burp target crawler
    2. Creating a functional graph
    3. Mapping the attack surface
    4. Client side validation
    5. Database interaction
    6. File uploading and downloading
    7. Display of user-supplied data
    8. Redirections
    9. Access control and login-protected pages
    10. Error messages
    11. Charting
14. Enumerating resources
    1. Crawling the website
    2. Finding hidden files
    3. Back up and source code
    4. Enumerating users accounts
    5. Map
15. Relevant information through misconfigurations
    1. Directory listing
    2. Log and configuration files
    3. HTTP verbs and file upload
16. Google hacking
    1. Search operators
17. Shodan HQ

CROSS-SITE SCRIPTING

18. Cross-Site Scripting Basics
19. Anatomy of an XSS Exploitation
20. The three types of XSS
    1. Reflected XSS
    2. Persistent XSS
    3. DOM-based XSS
21. Finding XSS in PHP code
22. XSS Exploitation
    1. XSS and Browsers
    2. XSS Attacks
    3. Cookie Stealing through XSS
    4. Defacement
    5. XSS for advanced phishing attacks
    6. BeEF
23. Frames
    1. Understand the need for frames in web pages
    2. Learn to create and work with frames
24. Mitigation
    1. Input Validation
    2. Context-Aware output encoding
    3. Never trust user input

SQL Injection

25. Introduction to SQL Injections
    1. SQL Statements
    2. SELECT
    3. UNION
    4. SQL Queries inside web applications
    5. Vulnerable dynamic queries
    6. How dangerous is a SQL Injection
    7. SQLi attacks classification
    8. In-band SQLi
    9. Error-based SQLi
    10. Blind SQLi
26. Finding SQL Injections
    1. Simple SQL Injection scenario
    2. SQL errors in web applications
    3. Boolean-based detection
    4. Example
27. Exploiting In-band SQL Injections
    1. First scenario
    2. In-band attack challenges
    3. Enumerating the number of fields in a query
    4. Different DBMS UNION mismatch errors
    5. Blind enumeration
    6. Identifying field types
    7. Dumping the database content
28. Exploiting Error-based SQL Injections
    1. MS SQL Server Error-based exploitation
    2. The CAST Technique
    3. Finding the DBMS version
    4. Dumping the database data
    5. Finding the current username
    6. Finding readable databases
    7. Enumerating database tables
    8. Enumerating columns
    9. Dumping data
    10. Video - Error-based SQLi
    11. MySQL Error-based SQLi
    12. PostgreSQL Error-based SQLi
    13. Developing Error-based SQLi Payloads
29. Exploiting blind SQLi
    1. String extraction
    2. Detecting the current user
    3. Scripting blind SQLi data dump
    4. Exploiting blind SQLi
    5. String extraction
    6. Optimize blind SQLi
    7. Time-based blind SQLi
30. SQLMap
    1. Basic syntax
    2. Extracting the database banner
    3. Information Gathering
    4. Extracting the Database
    5. Extracting the Schema
    6. Video – SQL Injection
    7. Video – SQLMap
    8. SQLMap Advanced Usage
    9. Forcing the DBMS
    10. Fine tuning the payloads
    11. Aggressiveness and load
    12. Conclusions
31. Mitigation Strategies
    1. Prepare statement
    2. Implementation
    3. Type casting
    4. Input validation
32. From SQLi to Server Takeover
    1. Advanced MySQL Exploitation
    2. xp_cmdshell
    3. Internet Network Host Enumeration
    4. Port Scanning
    5. Reading the File System
    6. Uploading Files
    7. Storing Command Results into a Temporary Table
    8. Advanced MySQL Exploitation
    9. Reading the File System
    10. Uploading Files
    11. Executing Shell Commands
    12. Conclusions

AUTHENTICATION AND AUTHORIZATION

33. Introduction
    1. Authentication vs. Authorization
    2. Authentication factors
    3. Single-factor authentication
    4. Two-factor authentication
34. Common Vulnerabilities
    1. Credentials over unencrypted channel
    2. Inadequate password policy
    3. Dictionary attacks
    4. Brute force attacks
    5. Defending from inadequate password policy Strong password policy Storing hashes Lockout/Blocking requests
    6. User enumeration
    7. Via error messages
    8. Via website behavior
    9. Via timing attacks
    10. Taking advantage of user enumeration
    11. Default or easily-guessable user accounts
    12. The remember me functionality
    13. Cache browser method
    14. Cookie method
    15. Web storage method
    16. Best defensive techniques
    17. Password reset feature
    18. Easily guessable answers
    19. Unlimited attempts
    20. Password reset link
    21. Logout weaknesses
    22. Incorrect session destruction
    23. CAPTCHA
35. Bypassing Authorization
    1. Insecure direct object references
    2. Best defensive techniques
    3. Missing function level access control
    4. Parameter modification
    5. Vulnerable web application
    6. Incorrect redirection
    7. Redirect to protect contents
    8. Best defensive techniques
    9. SessionID prediction
    10. SQL Injections
    11. Local file inclusion and path traversal

SESSION SECURITY

36. Weaknesses of the session identifier
37. Session hijacking
    1. Session Hijacking via XSS
    2. Exploit session hijacking via XSS
    3. Preventing session hijacking via XSS PHP, Java , .NET
    4. Session Hijacking via Packet Sniffing
    5. Session Hijacking via access to the web server
38. Session Fixation
    1. Attacks
    2. Set the SessionID
    3. Force the victim
    4. Vulnerable web application
    5. Preventing Session Fixation
39. Cross-Site Request Forgeries
    1. Finding CSRF
    2. Exploiting CSRF
    3. Preventing CSRF

FLASH SECURITY AND ATTACKS

40. Introduction
    1. Actionscript
    2. Compiling and decompiling
    3. Embedding Flash in HTML
    4. The allowScriptAccess attribute
    5. Passing arguments to Flash files
    6. Direct reference
    7. Flash embedded in HTML
    8. FlashArgs attribute
41. Flash Security Model
    1. Sandboxes
    2. Stakeholders
    3. Administrative role
    4. User role
    5. Website role
    6. URL policy file
    7. Author role
    8. Calling JavaScript from ActionScript
    9. Calling ActionScript from JavaScript
    10. Method NavigateToURL
    11. Local shared object
42. Flash Vulnerabilities
    1. Flash parameter injection
    2. Fuzzing Flash with SWFInvestigator
    3. Finding hardcoded sensitive information
43. Pentesting Flash Applications
    1. Analyzing client-side components
    2. Identifying communication protocol
    3. Analyzing server-side components

HTML5

44. Cross-Origin Resource Sharing
45. Cross-Windows Messaging
46. Web Storage
47. WebSocket
48. Sandboxed frames

FILE AND RESOURCE ATTACKS

49. Path Traversal
50. File Inclusion Vulnerabilities
51. Unrestricted File Upload

OTHER ATTACKS AND VULNERABILITIES

52. Clickjacking
53. HTTP Response Splitting
54. Business Logic Flow
55. Denial of Services

WEB SERVICES

56. Introduction
57. Web Services Implementations
58. The WSDL Language
59. Attacks

XPATH INJECTION

60. XML Documents and Databases
61. XPath
62. Detecting XPath Injection
63. Exploitation
64. Best Defensive Techniques

PENETRATION TESTING CONTENT MANAGEMENT SYSTEMS

65. Introduction
66. WordPress
67. Joomla

Penetration Testing NoSQL Databases

68. Introduction
69. NoSQL Fundamentals & Security
70. NoSQL Exploitation
Click Here Now To Get Your Free Demo