- Nullcon Berlin 2022
- Training
- Beyond the Web Application Hacker's Handbook
Beyond the Web Application Hacker's Handbook
Marcus Pinto
Note: Regarding COVID-19 safety, Nullcon will seek to ensure a safe event, as the health and safety of our exhibitors, delegates, speakers, and staff will always be our number one priority. Nullcon will follow all applicable health regulations required by the local and government authorities.
Trainer Name: Marcus Pinto
Title: Beyond the Web Application Hacker's Handbook
Duration: 3 Days
Dates: April 5, 2022 To April 7, 2022
TRAINING OBJECTIVES
Expand the capabilities of individuals with 3-4 years' experience in web application security assessment, by providing exposure to new technologies, logic puzzles, and writing burp extensions.
Training level: Intermediate to Advanced
COURSE OUTLINE
The course is heavily lab-based.
Day 1: Setting up, Tooling Up, Arming Up.
- on day 1 we help delegates locate areas of applications they may easily miss. We advise them on the best pre written burp extensions and describe the process of writing extensions
Day 2: Levelling Up
- on day 2 we walk delegates through the design vulnerabilities, covering Access Controls, Logic flaws, and how to really compromise encryption (no weak SSL ciphers or theoretical stuff here)
Day 3: Breaching the Server
- on day 3 we look at breaching the server using today's popular coding-related flaws: SSRF, Deserialisation, SSTI, File format exploitation, and Input Validation
WHAT TO BRING
Laptop with access to install and use Burp Suite Professional (a 3 week trial license for Professional will be provided with the course)
PREREQUISITES
Good knowledge of HTTP, HTML, Javascript and some working knowledge of web scripting languages
WHO SHOULD ATTEND
Software Engineers, Quality Assurance teams as well as seasoned Web Application Testers or Consultants moving over from Infrastructure / Network assessment backgrounds
WHAT TO EXPECT
- writing burp macros and writing Burp extensions
- finding and exploiting subtle but common logic and access control flaws
- techniques for getting more out of Burp Suite
- solving common penetration testing pitfalls
- beating input validation and other application defences
- fuzzing techniques and methodologies for interacting with new technologies
WHAT NOT TO EXPECT
- We do not provide access to the source for the labs
- We do not provide a full year license to Burp Suite Professional
- This course does NOT cover SQL Injection, File Traversal, or XSS. These topics are adequately covered, for free, elsewhere, and/or are relatively deprecated.
About Trainer
Marcus Pinto is the author of the Web Application Hacker's Handbook, still widely regarded as the leading text on professional application security assessment today. Marcus is director of MDSec Consulting Limited, working at the forefront of the industry with worldwide clients.