Offensive Perspective - OWASP Security for Developers

Focused View

Gabriel Avramescu

4:28:33

16 View

01 - Introduction and Agenda

001 Agenda.mp4

03:28

002 VMs used to replicate the lab.html

002 VMs-used-to-replicate-the-lab.txt

003 Additional Resources.html

003 Additional-resources.zip

02 - Overview of Web Penetration Testing

001 Overview of Web Penetration Testing.mp4

10:46

002 Information Gathering - Part 1.mp4

10:46

003 Information Gathering - Part 2.mp4

10:36

004 Information Gathering - Part 3.mp4

06:03

005 Scanning and Enumeration.mp4

03:20

006 Mapping.mp4

09:42

007 Attacking the users - Reflected XSS.mp4

10:28

008 Attacking the users - Stored XSS.mp4

15:28

009 Attacking the users - CSRF, Clickjacking, Open Redirect.mp4

11:56

010 Attacking the server - OS Command Injection.mp4

08:27

011 Attacking the Server - SMTP Injection.mp4

03:48

012 Attacking Authentication.mp4

08:32

013 Attacking the Datastore - SQLi part 1.mp4

11:56

014 Attacking the Datastore - SQLi part 2.mp4

12:18

03 - OWASP API Top 10 Vulnerabilities

001 API OWASP Top 10 - Part 1.mp4

15:20

002 API OWASP Top 10 - Part 2.mp4

12:34

04 - OWASP Web Top 10 Vulnerabilities

001 Web OWASP Top 10.mp4

17:58

05 - HTTP Security Headers

001 HTTP Security Headers.mp4

15:07

06 - JSON Web Tokens

001 JSON Web Tokens.mp4

16:49

07 - Technical Measures and Best Practices

001 Technical measures and best practices - part 1.mp4

13:45

002 Technical measures and best practices - part 2.mp4

14:05

08 - Cryptography

001 Cryptography - part 1.mp4

15:13

002 Cryptography - part 2.mp4

10:08

Description

Develop ”Out-of-box” thinking related to web secure codin and see security from offensive perspective

What You'll Learn?

Best practices when it comes to secure coding for web developers
OWASP Top 10 Web vulnerabilities
"Out-of-box thinking" when it comes to exploiting certain vulnerabilities
Learn certain tools and frameworks for offensive perspective

Who is this for?

Developers, Dev(Sec)Ops and software architects mostly

Also useful for system administrators, technical managers and CISO

Ethical Hackers, Penetration Testers, Bug Bounty Fans

What You Need to Know?

basic knowledge of HTTP Protocol, Linux and web development.

More details

Description
You will learn to protect your web application by attacking it, by performing penetration testing on it. This course is rather theoretical with only some labs and demos.

Objectives
Develop â€Out-of-boxâ€ thinking
See security from an offensive perspective
Learn best security practices and (most and less) common attacks
Learn to defend your applications and infrastructure
Topics
Overview of Web Penetration Testing
OWASP Top Ten Web Vulnerabilities
API Top Ten vulnerabilities
HTTP Security Headers
JSON Web Tokens
Technical measures and best practices
Cryptography
Overview of Web Penetration Testing
Core problems
Web Technologies basics
Security Audit vs Vulnerability Assessment vs Pentest
Information Gathering
Scanning and Enumeration
Mapping the target surface
Attacking Users. Cross Site Scripting
Attacking the Server
Attacking Authentication
Attacking Data Stores
Top 10 API Security Vulnerabilities
API Vulnerabilities
Examples of vulnerabilities found in publicly accessible applications
OWASP Top Ten Web Vulnerabilities
A1: Injection
A2 â€“ Broken Authentication and Session Management
A3 â€“ Cross-Site Scripting (XSS)
A4 â€“ Insecure Direct Object References
A5 â€“ Security Misconfiguration
A6 â€“ Sensitive data Exposure
A7 â€“ Missing Function Level Access Control
A8 â€“ Cross-Site Request Forgery (CSRF)
A9 â€“ Using Components with Known Vulnerabilities
A10 â€“ Unvalidated Redirects and Forwards
New Addition in OWASP TOP 10 - 2017
A4 - XML External entities (XXE)
A5 â€“ Broken Access Control
A8 â€“ Insecure Deserialization
A10 - Insufficient Logging & Monitoring
New additions in 2021
Common Vulnerabilities: XSS, SQL Injection, CSRF, XXE, LFI
HTTP Security Headers
Understand HTTP Security Tokens and their role
HSTS - Strict-Transport-Security
CSP - Content-Security-Policy
CORS
X-Frame-Options
X-XSS-Protection
X-Content-Type-Options
Referrer-Policy
Cookie flags: HTTPOnly, Secure
JSON Web Tokens
Understanding JSON WEB TOKENS
Token Structure
When can you use JWT
Issues
What is JWT good for?
Best Practices for JSON Web Tokens
Technical measures and best practices
Input Validation
Encoding
Bind Parameters for Database Queries
Protect Data in Transit
Hash and Salt Your Users' Passwords
Encrypt Data at Rest
Logging - Best practices
Authenticate Users Safely
Protect User Sessions
Authorize Actions
Cryptography
Cryptographic concepts
Algorithms
Cryptography and cryptanalysis tools
Cryptography attacks
Who this course is for:
Developers, Dev(Sec)Ops and software architects mostly
Also useful for system administrators, technical managers and CISO
Ethical Hackers, Penetration Testers, Bug Bounty Fans

User Reviews

Rating

average 0

Total votes0

Focused display

Senior Information Security Consultant- I work in the Internet security team, focused on ethical hacking - deliberately and purposefully challenging the IT security assumptions, strategies, and methods of protecting vital assets and information by emulating an adversary.- Scan and exploit for a wide variety of data center infrastructure and application vulnerabilities, following defined rules of engagement and attack scenarios (ethical hacking).- Make recommendations on security weaknesses and report on activities and findings. - Perform Internet penetration testing (black box / white box testing) and code reviews (manual and automated) - Use testing tools as NetBIOS scanning, network pinging and testing, packet crafting and analyzing, port scanning for vulnerability assessment- Perform analysis and testing to verify the strengths and weaknesses of Web Applications and Web Services (SML, SOAP, WSDL, UDDI, etc.)- Perform analysis and testing to verify the strengths and weaknesses of a variety of operating systems, network devices, web applications, and security architectures - Assist with the development of remediation services for identified findings - Customize, operate, audit, and maintain security related tools and applicationsIT Trainer - CEH, ECSA, CHFI, ECIH, ICS-SCADA Cybersecurity from EC-Council- Cisco CCNA, CCNA Security, Linux EssentialsCertifications- OSWE (Offensive Security Web Expert)- CREST Registered Penetration Tester (CRT)- ECIH (EC-Council Incident Handling)- Ec-Council ICS-SCADA Cybersecurity- OSCE (Offensive Security Certified Expert)- OSWP (Offensive Security Wireless Professional)- OSCP (Offensive Security Certified Professional)- CHFI (Computer Hacking Forensic Investigator)- ISO 270001 Lead Auditor- ECSA (EC-Council Security Analyst)- CEH (Certified Ethical Hacker)- CCNA and CCNA Security- CCNP Routing and CCNP Switching- Advanced Linux&InfoSEC- VMWare vSphere Install, Configure, Manage- Microsoft Certified Technology Specialist (MCTS/MCP 70-642): Microsoft Windows Server 2008 Network Infrastructure, etc.

Udemy

View courses Udemy

Students take courses primarily to improve job-related skills.Some courses generate credit toward technical certification. Udemy has made a special effort to attract corporate trainers seeking to create coursework for employees of their company.