About the course
Our instructor-led Penetration Testing (aka Pen Testing) training course will give you practical skills and ethical hacking techniques to analyse and plan to address vulnerabilities in network-facing applications.
We will introduce you to scanning tools, walk you through best practices for fortifying against and mitigating against threat, and reporting security issues within your organisation.
Instructor-led online and in-house face-to-face options are available - as part of a wider customised training programme, or as a standalone workshop, on-site at your offices or at one of many flexible meeting spaces in the UK and around the World.
-
- Why carry out Penetration testing?
- What is Ethical Hacking?
- Pen Testing Fundamentals
- Recon & Analysis
- Application Logic
- Access Handling
- Input Handling
- Application Hosting
- Other security testing disciplines
-
This workshop is aimed at Web Developers, Testers, Software Architects, Development Managers, Technical QA Managers and anyone interested in moving into a cyber security or information security role.
-
There are no pre-requisite skills needed for this training but some experience of software development or scripting in a language such as Java, C#, VB.NET, PHP, JavaScript, or Python would be useful.
-
This Penetration Testing course is available for private / custom delivery for your team - as an in-house face-to-face workshop at your location of choice, or as online instructor-led training via MS Teams (or your own preferred platform).
Get in touch to find out how we can deliver tailored training which focuses on your project requirements and learning goals.
-
Web Application Penetration Testing with OWASP 2021
This is a fundamentals course for those interested in finding out how to start analysing and penetration testing a web application.
Engagement
In this section we learn how to ensure that boundaries of the testing are properly organised, permissions are obtained, and the scope of the testing engagement notified.
Identifying Targets and Users
How do attackers know who the users of a website are? How easy is it to push the website to disclose sensitive information. In this session we use OSINT (Open Source Intelligence) tooling to attempt to gain an understanding of the public profile of the application and its users.
Footprint and Discovery
Before any effective testing can take place it is important to understand the environment the application is hosted on and in. The web application should be analysed to identify structure and content, the results analysed and the application scanned.
User Controls, Authentication and Session
After analysing the web application’s login options we will begin to use our toolset to bypass login controls, brute force access and manipulate sessions and cookies.
Automating Attacks on Databases, Encrypted and Hashed Resources
Learn how to use tools to crack encrypted and hashed passwords and other secured resources, and find Database vulnerabilities in the application’s data stores.
Input Validation
The weakest part of any application is its need to accept data input. We will attempt to identify vulnerabilities in an application by intercepting and manipulating data, using fuzzing techniques and other attempts to identify weaknesses.
Hosting Vulnerabilities
In this session we will look to see what the most common vulnerabilities are in hosted environments and how to identify them.
-
OWASP Top Ten 2021 Web Application Security Risks: The specific list of top web application security risks referenced in this course. https://owasp.org/www-project-top-ten/
OWASP Application Security Verification Standard (ASVS): A comprehensive list of application security requirements that can be used to establish secure development standards. https://owasp.org/www-project-asvs/
OWASP Cheatsheet Series: Provides concise, practical guidance on preventing common web application vulnerabilities through secure coding. https://cheatsheetseries.owasp.org/
Trusted by
