|
所在平台: Coursera |
课程主页: https://www.coursera.org/learn/exploiting-securing-vulnerabilities-java-applications
课程评论：没有评论
课程名称：Java应用程序的漏洞利用与安全防护 课程概述： 在本课程中，您将扮演多个角色。首先，作为攻击者，您将学习如何利用注入漏洞窃取数据，利用跨站脚本（XSS）攻击攻陷用户浏览器，破解认证以访问仅限“管理员”的数据和功能，甚至在远程服务器上运行代码以获取一些秘密。此外，您还将作为防御者，深入代码，修复这些问题的根本原因，并讨论各种缓解策略。我们将利用WebGoat——一个旨在教授渗透测试的OWASP项目，该应用程序故意存在多种漏洞，以此作为实践的平台。最终，您将修复WebGoat中的这些漏洞并构建修补后的二进制文件。课程中将讨论在线资源，帮助您深入学习，并寻找回馈更大应用安全社区的有效方式。 课程大纲： 1. 模块名称：跨站脚本攻击的设置与介绍 描述：您将学习使用Git和GitHub拉取所需的源代码，运行WebGoat于Docker容器中，并解释这样做的原因。您将能够描述跨站脚本攻击的工作原理及防御方法，并区分DOM型、反射型和存储型跨站脚本攻击，并实践防护不同类型的攻击。 2. 模块名称：注入攻击 描述：您将利用SQL注入漏洞，并规划缓解网页应用中的注入漏洞的策略。讨论各种查找和修复XML、实体和SQL攻击漏洞的方法，了解如何防范中间人攻击，并通过“戴上攻击者的帽子”思考来找到SQL注入漏洞。您将演示如何正确修改查询，使其成为准备语句，并使用XML查看器和文本编辑器分析代码以查找漏洞，最终在大型代码库中找到关键代码段并修补漏洞。 3. 模块名称：认证与授权 描述：评估各种认证缺陷，识别潜在问题并创建安全认证的策略和控制措施。创建和实施控制以缓解认证绕过问题，并从失败实例中汲取教训。正确实现如JSON Web Tokens（JWT）等认证方法，发现大型代码库中的漏洞并提供示范和利用JWT的解决方案。 4. 模块名称：易受攻击组件的危险与最终项目 描述：使用OWASP依赖检查器分析代码，确认代码中是否存在易受攻击的组件。检查代码以查找和修补这些漏洞，并应用之前模块的学习内容，最终完成您的项目。 此课程将帮助您全面理解Java应用程序的安全漏洞与防护措施，提升您的应用安全技能。
Name:Setup and Introduction to Cross Site Scripting Attacks
Description:In this module, you will be able to use Git and GitHub to pull needed source code. You will be able to run WebGoat in a Docker container and explain reasons for doing so. You'll be able to describe cross-site scripting attacks and explain how these attacks happen and how to guard against them. You'll be able to differentiate between a DOM-based, Reflected, and Stored cross-site scripting attacks. You will be able to practice protecting against various kinds of cross-site scripting attacks.
Name:Injection Attacks
Description:In this module, you will be able to exploit a SQL injection vulnerability and form plans to mitigate injection vulnerabilities in your web application. You will be able to discuss various approaches to finding and fixing XML, Entity and SQL attack vulnerabilities. You'll be able to describe and protect against a "man-in-the-middle" attack and describe the the thought process to find SQL injection vulnerabilities by "putting on the attacker's hat". You will be able to demonstrate how to properly modify queries to get them into prepared statements and analyze code while using an XML viewer and text editor to find vulnerabilities. You'll also be able to navigate a large code base to find critical segments of code and patch vulnerabilities.
Name:Authentication and Authorization
Description:In this module, you will be able to evaluate authentication flaws of various kinds to identify potential problems and create strategies and controls to provide secure authentication. You'll be able to create and/or implement controls to mitigate authentication bypass and draw lessons from notable instances where others failed to authenticate users. You will be able to properly implement authentication methods like JSON Web Tokens (JWT). You will be able to find vulnerabilities in a large code base and provide a solution for demonstrating and exploiting JSON Web Tokens (JWT).
Name:Dangers of Vulnerable Components and Final Project
Description:In this module, you will be able to use the OWASP Dependency Checker while analyzing code and verify that you have vulnerable components in the code. You will be able to examine code to find and patch vulnerable components. You will be able to apply what you learned from previous module activities to finalize your final project.
In this course, we will wear many hats. With our Attacker Hats on, we will exploit Injection issues that allow us to steal data, exploit Cross Site Scripting issues to compromise a users browser, break authentication to gain access to data and functionality reserved for the ‘Admins’, and even exploit vulnerable components to run our code on a remote server and access some secrets. We will also wear Defender Hats. We will dive deep in the code to fix the root cause of these issues and discuss various mitigation strategies. We do this by exploiting WebGoat, an OWASP project designed to teach penetration testing. WebGoat is a deliberately vulnerable application with many flaws and we take aim at fixing some of these issues. Finally we fix these issues in WebGoat and build our patched binaries. Together we will discuss online resources to help us along and find meaningful ways to give back to the larger Application Security community.
