AppSec for Developers
Virtual Learning: 2,050€ + IVA
REF: NSSAPPSEC Catálogo: Cybersecurity Área: Claranet Cyber Security (NotSoSecure), Cybersecurity
Duração:
2 dias
Próxima Data:
11 a 12 Aug 2025
Local:
Online
Descrição
In this 2-Day Intermediate hands-on course delegates will gain an understanding of application security vulnerabilities including the industry standard OWASP Top 10 list and learn strategies to defend against them. Pen testing (security testing) as an activity tends to capture security vulnerabilities at the end of the SDLC and then it is often too late to influence fundamental changes in the way the code is written.
This course uses a Defense by Offense methodology based on real world offensive research (not theory). That means everything we teach has been tried and tested on live environments and in our labs, so you can put it into practice as soon as the training is over
*PVP por participante. A realização do curso nas datas apresentadas está sujeita a um quórum mínimo de inscrições.
Destinatários
- Software developers (beginner to advanced)
- Development team leads
This course is suitable for software developers and development teams who want to build and maintain secure software. The syllabus considers different application development strategies, from preserving legacy applications to developing new products.
-
Área: Cybersecurity
-
Certificação Associada: N/A
Programa:
APPLICATION SECURITY BASICS
- Why do we need Application Security?
- Understanding OWASP TOP 10
UNDERSTANDING THE HTTP PROTOCOL
- Understanding HTTP/HTTPS protocol
- Understanding Requests and Responses – Attack Surface
- Configure Burpsuite to intercept HTTP/HTTPS traffic
SECURITY MISCONFIGURATIONS
- Common misconfigurations in Web Applications
- Sensitive Information exposure and how to avoid it
- Using Softwares with known vulnerabilities
INSUFFICIENT LOGGING AND MONITORING
- Types of Logging
- Introduction to F-ELK
AUTHENTICATION FLAWS
- Understanding Anti-Automation Techniques
- NoSQL Security
AUTHORIZATION BYPASS TECHNIQUES
- Securing JWT and OAuth
- Local file Inclusion
- Mass Assignment Vulnerability
CROSS-SITE SCRIPTING (XSS)
- Types of XSS
- Mitigating XSS
CROSS-SITE REQUEST FORGERY SCRIPTING
- Understanding CSRF
- Mitigating CSRF
SERVER-SIDE REQUEST FORGERY (SSRF)
- Understanding SSRF
- Mitigating SSRF
SQL INJECTION
- Error and Blind SQL Injections
- Mitigating SQL Injection
- ORM Framework: HQL Injection
XAML EXTERNAL ENTITY (XXE) ATTACKS
- Default XML Processors == XXE
- Mitigating XXE
UNRESTRICTED FILE UPLOADS
- Common Pitfalls around file upload
- Mitigating File upload vulnerability
DESERIALIZATION VULNERABILITIES
- What is Serialization?
- Identifying Deserialization functions and deserialized data
- Mitigation strategies for deserialization
CLIENT-SIDE SECURITY CONCERNS
- Understanding Same Origin Policy
- Client-Side Security headers and their server configurations
SOURCE CODE REVIEW
- How to validate source code security
- Walkthrough: How threat actors chain vulnerabilities to achieve greater impact
- Capture the Flag: a timed competition challenging you to spot flaws in different samples of source code
DEVSECOPS
- DevSecOps: what is it, how do you build it, and what tools can you use?
Pré-requisitos:
Delegates need to have a basic understanding of how web applications work with an added advantage for those who currently develop web applications. This training is a programming language agnostic.
A Laptop with minimum 4 GB RAM and 1 GB of extra space is also required.
Partilha:
Precisas de ajuda a encontrar o teu futuro?
