Course Code: owasp2
Duration: 14 hours
Overview:

The Open Web Application Security Project is an online community which creates freely-available articles, methodologies, documentation, tools, and technologies in the field of web application security.

OWASP offers testing frameworks and tools for identifying vulnerabilities in web applications and services

Audience

This course is directed at Developers, Engineers and Architects seeking to secure their web apps and services

Course Outline:
  • Introduction
    • The OWASP Testing Project
    • Principles of Testing
    • Testing Techniques Explained
    • Deriving Security Test Requirements
    • Security Tests Integrated in Development and Testing Workflows
    • Security Test Data Analysis and Reporting
  • The OWASP Testing Framework
    • Overview
    • Phase 1: Before Development Begins
    • Phase 2: During Definition and Design
    • Phase 3: During Development
    • Phase 4: During Deployment
    • Phase 5: Maintenance and Operations
    • A Typical SDLC Testing Workflow
  • Web Application Security Testing
    • Introduction and Objectives
    • Testing Checklist
    • Information Gathering
    • Test HTTP Methods (OTG-CONFIG-006)
    • Test HTTP Strict Transport Security (OTG-CONFIG-007)
  • Identity Management Testing
    • Test Role Definitions (OTG-IDENT-001)
    • Test User Registration Process (OTG-IDENT-002
    • Test Account Provisioning Process (OTG-IDENT-003)
    • Testing for Account Enumeration and Guessable User Account (OTG-IDENT-004)
    • Testing for Weak or unenforced username policy (OTG-IDENT-005)
  • Authentication Testing
    • Testing for default credentials (OTG-AUTHN-002)
    • Test remember password functionality (OTG-AUTHN-005)
    • Testing for Browser cache weakness (OTG-AUTHN-006)
    • Testing for Weak password policy (OTG-AUTHN-007)
    • Testing for Weak security question/answer (OTG-AUTHN-008)
    • Testing for weak password change or reset functionalities (OTG-AUTHN-009)
    • Testing for Weaker authentication in alternative channel (OTG-AUTHN-010)
  • Authorization Testing
    • Testing Directory traversal/file include (OTG-AUTHZ-001)
    • Testing for bypassing authorization schema (OTG-AUTHZ-002)
    • Testing for Privilege Escalation (OTG-AUTHZ-003)
    • Testing for Insecure Direct Object References (OTG-AUTHZ-004)
  • Session Management Testing
    • Testing for Cookies attributes (OTG-SESS-002)
    • Testing for Session Fixation (OTG-SESS-003)
    • Testing for Cross Site Request Forgery (CSRF) (OTG-SESS-005)
    • Testing for logout functionality (OTG-SESS-006)
    • Test Session Timeout (OTG-SESS-007)
    • Testing for Session puzzling (OTG-SESS-008)
  • Input Validation Testing
    • Testing for SQL Injection (OTG-INPVAL-005)
  • Business Logic Testing
    • Test Upload of Unexpected File Types (OTG-BUSLOGIC-008)
    • Test Upload of Malicious Files (OTG-BUSLOGIC-009)
  • Client side Testing
    • Testing for DOM based Cross Site Scripting (OTG-CLIENT-001)
    • Testing for JavaScript Execution (OTG-CLIENT-002)
    • Testing for HTML Injection (OTG-CLIENT-003)
    • Testing for Client Side URL Redirect (OTG-CLIENT-004)
    • Testing for CSS Injection (OTG-CLIENT-005)
    • Testing for Client Side Resource Manipulation (OTG-CLIENT-006)
    • Test Cross Origin Resource Sharing (OTG-CLIENT-007)