|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/the-complete-practical-web-application-penetration-testing/
课程评论：没有评论
课程名称：完整实用的Web应用渗透测试 课程概述：欢迎参加这门关于Web应用渗透测试的完整课程。该课程不需要参与者具备任何安全漏洞测试的先前知识，也不需要任何编码知识，尽管有编码基础会更好。课程通过实用实验演示方式，涵盖Web应用漏洞，以便于理解和实践。理论部分以可下载的PDF文件形式提供，讲解概念，而实践部分则通过演示进行教导。课程通过实际操作让学员掌握技能，最后，学员应能实现以下目标： - 理解Web应用渗透测试方法论 - 理解Web应用漏洞的概念 - 能够手动测试Web应用的漏洞 课程内容分为10种最常见的Web应用漏洞，涵盖2022年OWASP十大漏洞列表： 1. **注入漏洞**：包括SQL注入和命令注入，学习如何识别和测试这些漏洞。 2. **破损访问控制**：揭示网站中允许不受限制访问敏感资源的弱点。 3. **破损身份验证**：教授如何绕过身份验证方法，例如登录表单。 4. **JSON Web令牌**：展示JWT的测试与利用机制。 5. **敏感数据暴露**：揭示检测网站是否有防止数据泄漏的安全措施的技术。 6. **服务器端请求伪造（SSRF）**：学习如何利用该漏洞使网站揭示敏感资源。 7. **服务器端模板注入（SSTI）**：阐述其可能导致的严重后果，包括命令注入和系统完全接管。 8. **跨站脚本攻击（XSS）**：深入讲解存储型、反射型和DOM型XSS的实际应用。 9. **XML外部实体注入（XXE）**：解释XML的工作原理以及利用XXE的不同技术。 10. **跨站请求伪造（CSRF）**：教授如何设置测试环境以发现CSRF漏洞。 通过本课程，学员将系统掌握Web应用渗透测试的理论与实践技能。
Welcome to this complete course about web application penetration testing. The course doesn't require any prior knowledge of testing web applications for security vulnerabilities nor it requires any level of coding knowledge although it's preferred.This course covers web application vulnerabilities in a practical fashion using practical labs designed for demonstrations. The course contains a theoretical part to explain the concepts and a practical part for demonstration. Course theoretical part is packed into a downloadable PDF file as well.You will learn everything by doing and the course shows practical demonstrations on vulnerable systems designed for practicing your skills in web application penetration testing.At the end of this course learners should achieve the below objectives:· Understand Web application penetration testing methodology· Understand the concepts of web application vulnerabilities· Be able to conduct manual testing of web application vulnerabilitiesThe course is divided to cover 10 most common web application vulnerabilities covered in the OWASP top 10 list as of 2022.1- Injection vulnerabilities: Injection vulnerabilities are very common in today's websites. In this section you will get to understand what causes an injection vulnerability and be able to uncover its existence by looking through and testing the right parts in any web application. In injection vulnerabilities we cover the below categories· SQL Injection: Most common vulnerabilities against databases. You will learn the different types of SQL injection vulnerabilities in addition to the ability to test and uncover a SQL injection by performing practical exercises against vulnerable pages.· SQLmap: After you learned how to manually test for SQL injection, here you will learn how to automate your testing using one of the most popular tools used in SQL injection· Command Injection: Command injections comes as one of the most dangerous web application vulnerabilities as it allows for complete takeover the system. In this section, you will learn how to spot a command injection vulnerability and how to perform a proof of concept.2- Broken Access Control: This vulnerability also comes in the OWASP top 10 list as of 2022. We will cover to reveal weakness areas in a website that would allow unrestricted access to sensitive resources.3- Broken Authentication: This section will teach you how to bypass authentication methods such as login forms.4- JSON Web Tokens: JWTs are not considered as a web application vulnerability rather a kind of cookies used for authorization. In this section we will go through the process of showing the mechanisms of testing and exploiting these tokens.5- Sensitive Data Exposure: This section will reveal techniques that are used to see if a website has security measures against data leaks.6- SSRF aka server side request forgery: One of the recently added vulnerabilities to the OWASP top 10 list. You will learn how to use it make a website reveal sensitive resources and load internal running services.7- SSTI aka server side template injection: not commonly talked about but this section explains how such vulnerability may lead to devastating outcomes such as command injection and full system takeover.8- XSS aka Cross Site Scripting: Very well known and popular web application vulnerability. In this section we will practically explain Stored, Reflected and DOM-based XSS.9- XXE aka XML External Entity Injection: a vulnerability that occurs as a result of poor XML implementation. We will explain how XML works and see different techniques to exploit XXE.10- CSRF aka Cross Site Request Forgery: Very popular vulnerability that when exploited allows for unauthenticated actions against users. We will learn practically how to perform and setup a testing environment to uncover CSRF.
