Instructors: cirosec consultants

Duration: 2 days

Web-based applications have become favorite targets; not only because more and more companies provide web services, online shops, banking applications, employee portals and other interactive applications with web front ends, but also because new methods are available allowing for attacking and manipulating these systems.

"Hacking Extreme Web Applications" is concerned with attacks on web applications and back-end systems.

The intensive course teaches you about the methods used by attackers, and both well-known and lesser known techniques for attacking web applications and the databases and back ends located behind them. The training takes a hands-on approach: it is characterized by numerous laboratory exercises.

A laptop with a large number of tools will be available for each participant, allowing him/her to gain practical experience with an attacker's point of view. The trainers carry out security audits on a regular basis, and they are known as experts in the application security field.

The training covers all OWASP Top Ten 2013 vulnerability types.

Main topics:

Information gathering

• Traditional information gathering by banners, error pages, etc.
• Webserver fingerprinting
• Using crawlers
• Identifying metadata information
• Decompiling client components (Flash, Java applets, Silverlight)

Attacks on web and application servers

• Software vulnerabilities in web and application servers (buffer overflows, etc.)
• Exploiting misconfigurations (directory listings, etc.)
• Application framework vulnerabilities

Attacks on the transmission

• Eavesdropping on the communication, SSL-man-in-the-middle attacks
• SSL vulnerabilities and misconfigurations
• Vulnerabilities in application level encryption

Attacks on the application

• Attacks on the authentication process
• Attacks on stored passwords
• Bypassing CAPTCHAs
• Attacks on the session management
• Cross-site scripting (persistent, non-persistent, DOM-based)
• Cross-site request forgery (CSRF), vulnerabilities in anti-CSRF mechanisms
• Vulnerabilities in function level access control
• Vulnerabilities in object level access control
• File inclusion (local/remote)
• Open redirects
• Command injection
• File upload vulnerabilities
• Application logic vulnerabilities
• Vulnerabilities in client-side JavaScript logic
• Attacks on AJAX services
• HTML5-based attack vectors
• Web spoofing
• CORS (cross-origin resource sharing)

Attacks on the back end

• SQL injection / blind SQL injection
• LDAP injection
• Vulnerabilities in web services
• XML injection / XML bombs
• XPath injection
• XSLT injection

Systems covered:
Unix-based or Windows-based web servers, databases, application servers, etc.

Target group:
Administrators and security managers who are not afraid to see security through the attacker’s eyes, diving deeply into his world. The training is also interesting for developers and administrators of web servers and e-business systems. 

This course must definitely be considered an "advanced" training. The number of participants is limited to make sure the instruction is individual and effective.

Prerequisite:
Basic knowledge of HTTP, HTML and in the web server and database field. The exercises partly require using command-line tools on Linux. The trainers will be happy to assist in managing them in case help is needed.

Maximum number of participants: 15 persons 

Price: € 2,000

Date: February 3-4, 2020, the two days before the IT-Defense conference starts.

The training is conducted in German by two experienced trainers. They work as consultants and can thus complement the course with comprehensive and recent practical experience. 

You will receive CPE Points for participating in the training. The training takes 16 hours. You will get a certificate after having completed the training.

Location: 
Maritim Hotel Bonn
Godesberger Allee
53175 Bonn
Telefon: +49 228 8108-0
info.bon@maritim.de