Module 1: Web Application – Security Basics

What is Security?
What is Secure Coding ?
Why Anti-virus, Firewall, IPS, IDS is not enough to stop application hacking?
Why do you need a Web Application Firewall?
Protocol Basics of HTTP and HTTPS
What is a Stateless protocol,
Why Cookies and/or Sessions are an integral part of web applications?
What is a Web Server?
Database and its language basics
Issues in the protocol structures of web
A Holistic approach to Security
Secure the Network, Host & Application
Threat Modelling : Stride and Dread
RACI Matrix
Web Services

Module 2: Principles of Secure Development
The 8 Principles of Secure Development are basic foundation blocks for Secure Programming. Generally, these 8 principles are not followed during the Software Development process resulting in applications with tons of vulnerabilities that are easily exploited by hackers/intruders

Input Validation,
Output Validation,
Error Handling,
Authentication and Authorization,
Session Management,
Secure Communications,
Secure Storage and
Secure Resource Access

Module 3: OWASP & SANS Top Web Application Vulnerabilities – Attacks & Defenses
Attacks with Hands-on Labs on :

SQL Injection,
Cross Site Scripting,
Cross Site Request Forgery,
LDAP Injection,
Command Injection,
Parameter/Form Tampering,
Payment Gateway hacking
Improper Error Handling,
unvalidated Input,
Directory Traversal,
Cookie Poisoning,
Insecure storage,
Information Leakage,
Broken Account Management,
Denial of Service,
Buffer Overflow,
Log Tampering,
Broken Access Control,
Broken Session Management,
Session Fixation,
Security Misconfiguration.
File Upload and Download and many more

Module 4: Application Security Testing

Automatic and Manual Vulnerability Scanning with W3af, Wapiti, Nikto, BurpSuite
Vulnerability Scanning with Acunetix & Other Commercial Scanners
Vulnerability Scanning with NeXpose Community
SSL Strip & Man-in-the-Middle Attacks
Password Cracking
HTTP DOS
Automated and Manual Exploitation of Web Vulnerabilities using tons of Scripts
Vulnerability Assessment reporting with Remediations and Mitigations

CSD: Certified Secure Developer

Contact