10151142Web Application Security
Course Information
Description
This course provides a broad overview of the tools and techniques commonly used for web application security testing. In depth hands-on exercises are used to instruct the student in the proper selection and application of a given tool for the intended task. Also included are basic strategies for documenting and reporting on the outcome of the test. The student must demonstrate the ability to plan, and execute a basic web security audit in an environment that simulates a common business or organization. Open Source tools include: The BURP suite, Python, etc…
Total Credits
3
Course Competencies
  1. Install and configure web application and attack environments
    Assessment Strategies
    Skill demonstration
    Criteria
    you install a Java application server
    you configure an application server administrative interface
    you access the application server administrative interface
    you deploy vulnerable web applications
    you install a remote attack server
    you remotely access deployed applications from attack server
    you verify successful server and application installation
    your tasks meet minimum performance levels or above as specified in the course handout

  2. Analyze web application vulnerabilities
    Assessment Strategies
    Skill demonstration, presentation
    Criteria
    you identify common web application vulnerabilities, such as XSS, CSRF, and SQL injection
    you demonstrate web application vulnerability behavior by describing how an attacker would use the vulnerability
    you verbally present information on web application vulnerabilities describing what they are and demonstrating the frequency of occurrence, conditions to occur, and how to defend against
    your tasks meet minimum performance levels or above as specified in the course handout

  3. Perform web application penetration testing – reconnaissance
    Assessment Strategies
    Skill demonstration
    Criteria
    you install and use tools to identify application target information
    you use a remote attack server to identify application targets and supporting infrastructure
    you use network protocols to learn domain names, technical contact information, target IP addresses, and hosts
    you use external information sources to passively and discreetly learn about targets
    your tasks meet minimum performance levels or above as specified in the course handout

  4. Perform web application penetration testing – mapping
    Assessment Strategies
    Skill demonstration
    Criteria
    you use a remote attack server to complete port scans and fingerprint the supporting operating systems
    you analyze the application encryption design
    you analyze virtual hosting and load balancer designs
    you identify the target components
    you install and use tools to map application infrastructure and software configurations
    your tasks meet minimum performance levels or above as specified in the course handout

  5. Perform web application penetration testing – server-side discovery
    Assessment Strategies
    Skill demonstration
    Criteria
    you install and use tools to discover server-side application vulnerabilities
    you execute web application vulnerability scanners and analyze the results
    you install web browser plug-ins to assist in automated vulnerability identification
    you attempt server-side vulnerability discovery, such as directory traversal
    you install and use tools to discover server-side application vulnerabilities
    your tasks meet minimum performance levels or above as specified in the course handout

  6. Perform web application penetration testing – client-side discovery
    Assessment Strategies
    Skill demonstration
    Criteria
    you install and use tools to discover client-side application vulnerabilities
    you execute client-side vulnerability scanning and analyze the results
    you perform business application attacks on a vulnerable web application
    you perform web services vulnerability attacks on a vulnerable web application
    your tasks meet minimum performance levels or above as specified in the course handout

  7. Perform web application penetration testing – exploitation
    Assessment Strategies
    Skill demonstration
    Criteria
    you install and use tools to exploit vulnerable web applications and verify vulnerabilities exist
    you verify that vulnerabilities such as XSS, SQL injection, and CSRF, identified in the discovery phases exist
    you bypass authentication mechanisms in a vulnerable web application
    you find hidden content and use it in a vulnerable web application
    you bypass client-side controls to exploit vulnerabilities
    you perform injection attacks, such as SQL and AJAX JSON injection, in a vulnerable web application
    your tasks meet minimum performance levels or above as specified in the course handout

  8. Exploit vulnerable web applications with the Browser Exploitation Framework (BeEF)
    Assessment Strategies
    Skill demonstration
    Criteria
    you use BeEF to “hook” web applications and take control of them
    you run BeEF exploitation commands to break into web applications
    you use BeEF to perform network reconnaissance and mapping
    your tasks meet minimum performance levels or above as specified in the course handout

  9. Install and configure a security information and event management (SIEM) system
    Assessment Strategies
    Skill demonstration
    Criteria
    you install a SIEM appliance
    you configure the SIEM to monitor a web application environment
    you test deployment of a SIEM by using a remote attack environment to attack the application and monitor security alerts
    your tasks meet minimum performance levels or above as specified in the course handout

  10. Install and configure a web application firewall (WAF)
    Assessment Strategies
    Skill demonstration
    Criteria
    you install, configure, and test deployment of a web application firewall
    you install and configuring a proxy server
    you install and configure a web application firewall
    you test deployment of a web application firewall
    you use a remote attack environment to attack a web application and block the attacks with the WAF
    your tasks meet minimum performance levels or above as specified in the course handout