Offensive Security - Web Hacking
About This Course
This comprehensive programme equips participants with the knowledge and skills necessary to conduct ethical penetration testing of web applications. By delving into the core principles of web technology, common attack vectors, and industry-standard tools, participants will gain a comprehensive understanding of web application security vulnerabilities and their mitigation strategies.
What You'll Learn
- Understand the inner workings of web applications, including HTTP and the web stack, to identify potential vulnerabilities
- Master the Open Worldwide Application Security Project (OWASP) Top 10, a critical framework for identifying and exploiting common web application security risks
- Gain expertise in various web application attack vectors, including injection attacks (SQL, XSS, CSRF), OS command injection, Denial-of-Service (DoS), Local file inclusion (LFI), and Remote file inclusion (RFI)
- Utilise Burp Suite, a leading web application security testing tool, to scan for vulnerabilities and manually exploit them in a controlled environment
Entry Requirements
Solid understanding of computer networking concepts: Familiarity with IP addresses, protocols (TCP/IP), network devices (routers, firewalls), and basic network topologies is crucial.
Basic understanding of operating systems: Knowledge of Windows and Linux, including file systems, user accounts, and permissions, would be beneficial.
Comfort with command-line interfaces (CLI): Many of the tools used in ethical hacking, like Nmap and Metasploit, operate through a command-line interface.
Analytical thinking and problem-solving skills: Ethical hacking involves identifying vulnerabilities and creatively exploiting them.
Prior programming experience: While not mandatory, some experience with scripting languages like Python or Bash can be helpful for understanding certain tools and automating tasks.
Commitment to ethical hacking practices: This course emphasizes using learned skills for authorized penetration testing and vulnerability research, not malicious purpose.