WAPT

WEB APPLICATON PENETRATION TESTING

SYLLABUS
What you will learn
The learning path covers workstation setup, including
installation and configuration of Burp Suite with the Firefox web browser. Certificate
installation and proxy configurations are covered in order to allow newcomers to start
pentesting immediately.

Focuses on the OWASP Top Ten vulnerabilities. Many real-world

vulnerabilities are showcased for each of the ten topics and various demos are given on
how to solve related challenges in Portswigger’s Web Security Academy.

Covers a variety of pentesting tools and Burp extensions such as Turbo Intruder,
Intruder File Payload Generator, SQLMap and many more.

Course closes out the learning path with pentesting advice, a path recap and a
look at the final project.
Introduction
◯ Introduction to the course.
◯ How to get most out of the course
◯ Resources you will need for the course
◯ What is WAPT?
Introduction to Web-application
◯ What is web application?
◯ History of Web-Applications
◯ Existing problems and challenges in
present web applications
◯ Overview of web application defences
Basics
◯ How a web application works
◯ Architecture of web applications
◯ Basics of HTML, CSS and Javascript
◯ Basics of any server-side language
(PHP/J2EE/ASP.NET)
Reconnaissance
◯ Foot printing Domain details (whois) -
Technicalinfo.net
◯ OS and Service fingerprinting – Netcraft.com,
Banner grabbing, HTTPprint
◯ Google hacking
◯ Load balancer Identification
◯ Spidering a web site (wget, Burp spider)
Server-side and Client-side security controls
◯ Input Validation & Output validation (encoding)
◯ Insufficient input & output validations
◯ Validation approaches
◯ Bypass Server-side validations
Mastering Burp suite
◯ Introduction to burp suite
◯ Configuring burp suite
◯ Burp proxy, Burp Spider, Burp Intruder, Burp
Repeater, Burp Sequencer

HTTP Protocol
Injections
◯ Overview of RFC 2616
◯ SQL Injection, Blind SQL Injection, Command
◯ HTTP Messages & Entities
Injection, LDAP Injection, XPATH Injection,
◯ HTTP Request, HTTP Response
Other Injections
◯ HTTP Status Codes
◯ Implications of Injections
◯ Various types of encoding schemes
◯ Test methodology for injections
◯ Remediation
Web servers and clients
IIS Server, Apache Server and Other
Cross-site Scripting
◯

Servers ◯ Reflected XSS, Stored XSS, DOM XSS

◯ Browsers ◯ Implications of XSS
◯ Browser’s same origin policy ◯ Test Methodology for XSS
◯ Other Web enabled Clients ◯ Remediation

Types of web application security Cross-site Request Forgery

testing
◯ CSRF with GET method
◯ Black box testing ,White box testing &
◯ CSRF with POST method
Grey box testing
◯ Implications of CSRF
◯ Vulnerability Assessment vs Penetration
◯ Test methodology for CSRF
testing
◯ RemediationCross-site Request Forgery
◯ Infrastructure and Application Admin
◯ CSRF with GET method
Interfaces
◯ CSRF with POST method
◯ Web application penetration test scope
◯ Implications of CSRF
and process
◯ Test methodology for CSRF
◯ Legalities of the VAPT
◯ Remediation
Authentication testing Brute force web applications
◯ Guessable Passwords ◯ Brute force authentication,
◯ Failure Messages ◯ Brute force Authorization,
◯ Brute forcing login ◯ Brute force web services,
◯ Plain text password transmission ◯ Brute force web server.
◯ Improper implementation of forgot
Parameter Manipulation
password functionality
◯ Query string manipulation
◯ Remember Me Functionality
◯ Form field manipulation
◯ Guessable User names
◯ Cookie manipulation
◯ Multi factor authentication flaws
◯ HTTP header manipulation
◯ Fail-Open Login Mechanisms
Insecure Storage of Credentials
Firefox security Add-ons
◯

◯ Remediation ◯ Tamper Data

◯ SQL inject me
Authorization testing ◯ XSS me
◯ Introduction to authorization
◯ Firebug
◯ Implementation weaknesses in
◯ Live HTTP headers
authorization
◯ Foxy Proxy
◯ Horizontal privilege escalation
◯ Web Developer
◯ Vertical privilege escalation
◯ URL, Form, cookie based escalation Automated Scanners
◯
◯ Acunetix, Netsparker, Burp Scanner
SSL& Configuration testing ◯ Effectiveness of Automated tools
◯ Reduction of False positives and false Negatives
◯ Testing SSL / TLS cipher
◯ Testing SSL certificate validity–client and
server
◯ Infrastructure and Application Admin
Interfaces
◯ Testing for HTTP Methods
◯ Testing for file extensions handling
◯ Old, Backup and Unreferenced Files
◯ Application Configuration Management
Testing
◯

Session Management testing

◯ Need for session and state
◯ Ways to implement state
◯ How session state work
◯ What are cookies
◯ Common Cookies and Session Issues
◯ Man in the middle