AppSec for Developers

Classroom: 1,750€ +Iva

REF: NSSAPPSEC Catálogo: Cybersecurity Área: Claranet Cyber Security (NotSoSecure), Cybersecurity

Duração icon

Duração:

2 dias

Próxima Data icon

Próxima Data:

Consulte-nos

Local icon

Local:

Descrição

In this 2-Day Intermediate hands-on course delegates will gain an understanding of application security vulnerabilities including the industry standard OWASP Top 10 list and learn strategies to defend against them.

Pen testing (security testing) as an activity tends to capture security vulnerabilities at the end of the SDLC and then it is often too late to influence fundamental changes in the way the code is written.

Web application security tends to be addressed only when vulnerabilities are found on applications running in production. Addressing these vulnerabilities at that stage becomes an expensive affair. These vulnerabilities arise primarily because developers are not sensitized against their impact and more importantly their fixing/patching.

Destinatários

This course is ideal for Web/API developers who work day-in-day out building full-stack web applications or web APIs. Anyone who is looking to develop a skill-set into web application security and is looking to identify web application flaws will also benefit from this course.

  • Área: Cybersecurity

  • Certificação Associada: N/A

Quero inscrever-me.

*Curso disponível em Live Training

Programa:

APPLICATION SECURITY BASICS

  • Why do we need Application Security?
  • Understanding OWASP TOP 10

UNDERSTANDING THE HTTP PROTOCOL

  • Understanding HTTP/HTTPS protocol
  • Understanding Requests and Responses – Attack Surface
  • Configure Burpsuite to intercept HTTP/HTTPS traffic

SECURITY MISCONFIGURATIONS

  • Common misconfigurations in Web Applications
  • Sensitive Information exposure and how to avoid it
  • Using Softwares with known vulnerabilities

INSUFFICIENT LOGGING AND MONITORING

  • Types of Logging
  • bIntroduction to F-ELK

AUTHENTICATION FLAWS

  • Understanding Anti-Automation Techniques
  • NoSQL Security

AUTHORIZATION BYPASS TECHNIQUES*

  • Securing JWT and OAuth
  • Local file Inclusion
  • Mass Assignment Vulnerability

CROSS-SITE SCRIPTING (XSS)

  • Types of XSS
  • Mitigating XSS

CROSS-SITE REQUEST FORGERY SCRIPTING

  • Understanding CSRF
  • Mitigating CSRF

SERVER-SIDE REQUEST FORGERY (SSRF)

  • Understanding SSRF
  • Mitigating SSRF

SQL INJECTION

  • Error and Blind SQL Injections
  • Mitigating SQL Injection
  • ORM Framework: HQL Injection

XAML EXTERNAL ENTITY (XXE) ATTACKS

  • Default XML Processors == XXE
  • Mitigating XXE

UNRESTRICTED FILE UPLOADS Common Pitfalls around file upload Mitigating File upload vulnerability

DESERIALIZATION VULNERABILITIES

  • What is Serialization?
  • Identifying Deserialization functions and deserialized data
  • Mitigation strategies for deserialization

CLIENT-SIDE SECURITY CONCERNS

  • Understanding Same Origin Policy
  • Windows Desktop ‘Breakout’ and AppLocker Bypass Techniques (Win 10)
  • Client-Side Security headers and their server configurations

SOURCE CODE REVIEW

  • What to check for Security in source code
  • CTF: A timed game to spot the flaws in the given Source Code samples

DEVSECOPS

  • DevSecOps – What Why and How?
  • Case Study

Pré-requisitos:

Delegates need to have a basic understanding of how web applications work with an added advantage for those who currently develop web applications. This training is a programming language agnostic.

A Laptop with minimum 4 GB RAM and 1 GB of extra space is also required.

Quero inscrever-me.

Share:

Facebook logo Linkedin logo Email icon
We meet future and then we make it spark slogan

Precisas de ajuda a encontrar o teu futuro?

The answer you entered for the CAPTCHA was not correct.

A background of the Ignit sparks