Web Application Security | Madison College Outline of Instruction

10151142 Web Application Security

Course Information

Description

This course provides a broad overview of the tools and techniques commonly used for web application security testing. In depth hands-on exercises are used to instruct the student in the proper selection and application of a given tool for the intended task. Also included are basic strategies for documenting and reporting on the outcome of the test. The student must demonstrate the ability to plan, and execute a basic web security audit in an environment that simulates a common business or organization. Open Source tools include: The BURP suite, Python, etc…

Total Credits

Course Outcomes

Install and configure web application and attack environments

Assessment Strategies

Skill demonstration

Criteria

you install a Java application server

you configure an application server administrative interface

you access the application server administrative interface

you deploy vulnerable web applications

you install a remote attack server

you remotely access deployed applications from attack server

you verify successful server and application installation

your tasks meet minimum performance levels or above as specified in the course handout
Analyze web application vulnerabilities

Assessment Strategies

Skill demonstration, presentation

Criteria

you identify common web application vulnerabilities, such as XSS, CSRF, and SQL injection

you demonstrate web application vulnerability behavior by describing how an attacker would use the vulnerability

you verbally present information on web application vulnerabilities describing what they are and demonstrating the frequency of occurrence, conditions to occur, and how to defend against

your tasks meet minimum performance levels or above as specified in the course handout
Perform web application penetration testing – reconnaissance

Assessment Strategies

Skill demonstration

Criteria

you install and use tools to identify application target information

you use a remote attack server to identify application targets and supporting infrastructure

you use network protocols to learn domain names, technical contact information, target IP addresses, and hosts

you use external information sources to passively and discreetly learn about targets

your tasks meet minimum performance levels or above as specified in the course handout
Perform web application penetration testing – mapping

Assessment Strategies

Skill demonstration

Criteria

you use a remote attack server to complete port scans and fingerprint the supporting operating systems

you analyze the application encryption design

you analyze virtual hosting and load balancer designs

you identify the target components

you install and use tools to map application infrastructure and software configurations

your tasks meet minimum performance levels or above as specified in the course handout
Perform web application penetration testing – server-side discovery

Assessment Strategies

Skill demonstration

Criteria

you install and use tools to discover server-side application vulnerabilities

you execute web application vulnerability scanners and analyze the results

you install web browser plug-ins to assist in automated vulnerability identification

you attempt server-side vulnerability discovery, such as directory traversal

you install and use tools to discover server-side application vulnerabilities

your tasks meet minimum performance levels or above as specified in the course handout
Perform web application penetration testing – client-side discovery

Assessment Strategies

Skill demonstration

Criteria

you install and use tools to discover client-side application vulnerabilities

you execute client-side vulnerability scanning and analyze the results

you perform business application attacks on a vulnerable web application

you perform web services vulnerability attacks on a vulnerable web application

your tasks meet minimum performance levels or above as specified in the course handout
Perform web application penetration testing – exploitation

Assessment Strategies

Skill demonstration

Criteria

you install and use tools to exploit vulnerable web applications and verify vulnerabilities exist

you verify that vulnerabilities such as XSS, SQL injection, and CSRF, identified in the discovery phases exist

you bypass authentication mechanisms in a vulnerable web application

you find hidden content and use it in a vulnerable web application

you bypass client-side controls to exploit vulnerabilities

you perform injection attacks, such as SQL and AJAX JSON injection, in a vulnerable web application

your tasks meet minimum performance levels or above as specified in the course handout
Exploit vulnerable web applications with the Browser Exploitation Framework (BeEF)

Assessment Strategies

Skill demonstration

Criteria

you use BeEF to “hook” web applications and take control of them

you run BeEF exploitation commands to break into web applications

you use BeEF to perform network reconnaissance and mapping

your tasks meet minimum performance levels or above as specified in the course handout
Install and configure a security information and event management (SIEM) system

Assessment Strategies

Skill demonstration

Criteria

you install a SIEM appliance

you configure the SIEM to monitor a web application environment

you test deployment of a SIEM by using a remote attack environment to attack the application and monitor security alerts

your tasks meet minimum performance levels or above as specified in the course handout
Install and configure a web application firewall (WAF)

Assessment Strategies

Skill demonstration

Criteria

you install, configure, and test deployment of a web application firewall

you install and configuring a proxy server

you install and configure a web application firewall

you test deployment of a web application firewall

you use a remote attack environment to attack a web application and block the attacks with the WAF

your tasks meet minimum performance levels or above as specified in the course handout