Web application Penitration Testing Training & Certification [WAPT]

• Weekdays - 4 weeks
• Weekend – 5 weeks
• FastTrack Batch - 3.5 weeks

• Weekdays – 4.5 weeks
• Weekend – 5.5 weeks
• FastTrack Batch - 3.5 weeks

• Introduction to Information Security
• Hacking Methodologies and Types of Security Testing
• Computer Networking
• IP Addressing and NAT
• DNS- The Google Maps of the Internet
• Ports and Services
• Protocols, TCP/IP and OSI Model
• Proxy and VPN
• Module Test

• Digital Footprints and Information Gathering
• Advanced Information Gathering about People and Websites
• Google Dorking- Hacking using Google
• Introduction to Web Architecture and Understanding Common Security Misconceptions
• HTML Basics
• HTML and Introduction to Javascript
• Introduction to PHP and Setting up XAMPP
• Putting Brains into Beauty- Working with PHP
• Handling User Input and Building Basic Applications using PHP
• Module Test

• Introduction to VAPT and OWASP
• Basics of Databases and SQL
• Authentication Bypass using SQL Injection
• GET based SQL Injection- Part 1
• GET based SQL Injection- Part 2
• POST based SQL Injection- Part 1
• POST based SQL Injection- Part 2
• Advanced SQL Injections
• Automating SQL Injections- SQL Map
• Module Test

• Bypassing Client-Side Filters using Burp Suite
• IDOR and Rate-limiting issues
• Arbitrary File Upload Vulnerabilities
• Module Test

• Understanding Important Response Headers, DOM, and Event Listeners
• Fundamentals of Cross Site Scripting (XSS)
• Understanding Forced Browsing and Session-Cookie Flaws
• Cross Site Request Forgery (CSRF) and Open Redirections
• Brute Force Attacks using Burp Suite
• Personally, Identifiable Information (PII) Leakage and Sensitive Information Disclosure
• Module Test

• Common Security Misconfigurations
• Default/Weak Password Vulnerabilities
• Fingerprinting Components with Known Vulnerabilities
• Scanning for Bugs in WordPress and Drupal
• Using Public Exploits and Looking at Live Case Studies
• Module Test

• Information Gathering for Endpoints
• Application Assessment using Nmap
• Automating VAPT with Nikto and Burp Suite Pro
• Concepts of Code Security and Patching
• Module Test

• Documenting Stages of Vulnerabilities using Tools
• VAPT Reports: Developer Report v/s Higher Management Report
• Parts of a VAPT Report
• Common Good Practices and Bad Practices
• Module Test

Problem Statement: - Run your SQL command on a live website

Description: - SQL injection is the CRUD operation against a database of a website to affects its operations and give the attacker an opportunity to run their own SQL command against the database using the frontend of the website. Here we will understand how text box input is the best friend for a attacker.

Problem Statement: - Make a File and resource attack by changing resource identifiers.

Description: - With this kind of attack we change resource identifiers used by an application in order to perform a malicious task. As an application defines a resource type or location based on user input like file name or port number, this data can be manipulated to execute or access different resources. An application that permits input of special characters like period, slash, and backslash is risky when used in conjunction with methods that interact with the file system. Resource injection differs from path manipulation as it focuses on accessing resouces other than the local file system.

Problem Statement: - Path Traversal and Local File Inclusion vulnerability test on wordpress website.

Description: - WordPress is mostly used website building tool over internet with 35% of market share. Huge number of active installations all gives a massive attack surface. A regular attempt is made to hack into WordPress sites. On getting access to an account with at least author privileges on target WordPress site one can execute arbitrary PHP code on the underlying server and can get a full remote takeover. We will learn about both Path Traversal and Local File Inclusion vulnerability was automatically detections.