Duration 5 days – 35 hrs
Overview
This 5-day hands-on course teaches participants how to identify, exploit, and remediate vulnerabilities in web applications using open-source tools and techniques. The training covers the OWASP Top 10, secure coding practices, threat modeling, and defense strategies, ensuring that developers, testers, and security professionals can build and maintain secure applications without heavy reliance on paid tools.
Objectives
- Understand the security landscape of modern web applications.
- Recognize and remediate vulnerabilities based on the OWASP Top 10.
- Perform basic penetration testing using open-source tools.
- Implement secure coding best practices.
- Use open-source tools for vulnerability scanning, analysis, and reporting.
- Integrate security into the Software Development Life Cycle (SDLC) and CI/CD pipelines.
Audience
- Web Developers and Software Engineers
- QA/Test Engineers and Security Testers
- DevOps Engineers
- Cybersecurity Professionals
- System Administrators managing web servers
- Anyone interested in practical web security techniques
Prerequisites
- Basic knowledge of web development (HTML, JavaScript, APIs)
- Familiarity with how web applications work (HTTP, client-server model)
- (Optional) Basic knowledge of Linux command-line and networking concepts
Course Content
Day 1: Introduction to Web Application Security and the OWASP Top 10
- Web Application Security Basics
- Understanding Threats, Vulnerabilities, and Risk
- OWASP Top 10 Overview (2021)
- A01: Broken Access Control
- A02: Cryptographic Failures
- A03: Injection (SQL, XSS, Command Injection)
- Setting Up the Lab Environment (DVWA, OWASP Juice Shop)
- Hands-on: Initial Vulnerability Discovery Using OWASP ZAP (Zed Attack Proxy)
Day 2: Practical Vulnerability Discovery and Exploitation
- A04: Insecure Design
- A05: Security Misconfiguration
- A06: Vulnerable and Outdated Components
- A07: Identification and Authentication Failures
- Manual Testing Techniques
- Open Source Tools:
- OWASP ZAP Advanced Usage
- Nikto (Web Server Scanner)
- Hands-on: Exploiting and Reporting Basic Vulnerabilities
Day 3: Defensive Coding and Secure Development Practices
- Secure Input Validation and Output Encoding
- Secure Session Management Techniques
- Authentication and Authorization Best Practices
- Protecting Against Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF)
- Hands-on Secure Coding Labs (Python/PHP/JavaScript samples)
- Threat Modeling Basics (using OWASP Threat Dragon)
Day 4: Automation, API Security, and Advanced Techniques
- Introduction to API Security: OWASP API Top 10
- Testing RESTful APIs for Security Flaws
- Automation of Scans in CI/CD Pipelines (using GitHub Actions and OWASP ZAP CLI)
- Hands-on: Securing APIs and Automating Security Tests in Development Pipelines
- Open Source Tools: Postman (Security Testing APIs), Insomnia, K6 for API Load/Security Tests
Day 5: Capture-the-Flag Challenge and Secure Development Lifecycle (SDL)
- Secure Development Lifecycle (SDL)
- Integrating Security into Agile/Scrum
- Introduction to Bug Bounty Programs and Responsible Disclosure
- Full Hands-on CTF Challenge (Using DVWA or Juice Shop)
- Group Presentation:
- Identify vulnerabilities
- Propose mitigation strategies
- Final discussion and course wrap-up
