Web Site Audit

This course will teach you how to implement a real web site audit procedure. You will be confronted with web application security issues. You will study the audit process, both from a methodological and technical perspective. The different aspects of an analysis will be highlighted through several practical exercises. This training is intended for people who want to be able to perform technical tests during a web site audit or deployment.

Specific objectives:

• Understand and exploit different web site vulnerabilities
• Expand the scope of vulnerability exploitation for penetration testing

• HSA course level
• Knowledge of web development languages

• Code: AUDWEB
• Duration: 3 days
• Schedule: 8:30 AM - 5:30 PM
• Location: Training Center, Centre Urbain Nord, Tunis

• Security Consultants
• Engineers / Technicians
• Developers

• Course materials
• 40% demonstration
• 40% theory
• 20% practical exercises

• Day 1
  • Introduction
  • Audit methodology reminder and Action plan
  • Information gathering and Scanning
  • Vulnerability research and exploitation
  • Reconnaissance
  • Passive reconnaissance
  • WHOIS databases
  • Active reconnaissance
  • Site visit as a user
  • Search for admin pages
  • Search for default files (robots.txt, sitemap)
  • Detection of used technologies
  • Countermeasures
  • Limit network exposure
  • Filter access to admin pages and sensitive pages
  • Replace verbose error messages with generic ones
  • Scanning
  • Different types of scanners
  • Scanner limitations
• Day 2
  • Design vulnerabilities
  • Update policy
  • Communication encryption
  • Password policy
  • Inter-account isolation
  • Access to other users' data
  • Modification of personal information
  • Session management
  • Web vulnerabilities
  • Setting up a Proxy solution
  • Cross-site Scripting (XSS)
  • Cross-site Request Forgery (CSRF)
  • SQL Injection
  • Command Injection
  • Server Side Includes (SSI)
  • Object Injection
  • Exploitation and Countermeasures
• Day 3
  • Web vulnerabilities (continued)
  • File Inclusion
  • Local File Inclusion (LFI)
  • Remote File Inclusion (RFI)
  • Countermeasures
  • File Upload
  • Basic exploitation
  • Content-type verification
  • Blocking dangerous extensions
  • Countermeasures
  • XML External Entity (XXE)
  • Entities
  • Discovering the vulnerability
  • Exploiting the vulnerability
  • Countermeasures
  • Server Side Template Injection (SSTI)
  • Example of Twig usage
  • Example of Twig exploitation
  • Example of Flask exploitation
  • Countermeasures
  • Final Challenge