Foundstone Ultimate Web Hacking

Classroom Learning

Also available via

Who Needs to Attend

If you are a system and network administrator, security personnel, an auditor, consultant, and/or Web designer concerned with Web security, then you should take this course. Basic UNIX and Windows NT competency is required for the course to be fully beneficial.

Prerequisites

We recommend experience in web development and web programming, a basic UNIX and Windows NT competency, and a basic understanding of security principles.

The following will help you achieve or refresh your skills:

Follow-On Courses

As web technology mushrooms, vulnerabilities multiply and hackers are continuously looking to take advantage of them. In the Internet Age, the way into a company's network is often right through its web sites. Attackers no longer need back doors or sophisticated tools to compromise a system. Security professionals need to learn how to secure and monitor their web-enabled enterprise by identifying vulnerabilities that can be exploited both internally and externally.

Because the web is exploding faster than any other business technology, legacy systems in the enterprise are being replaced at a rapid rate. Browser-based applications powered by web servers and back-end databases are constantly being evaluated and updated. With every application that an enterprise brings online or e-business that goes live, malicious hackers are waiting to attack.

This ultimate web security class from Global Knowledge and Foundstone provides security professionals with the knowledge and tools to recognize vulnerabilities, develop countermeasures, and perform ongoing assessments. In a hands-on setting, Ultimate Web Hacking offers demonstrations on how attackers can access corporate information with little more than a web browser.

Continuing Education Credit
This course qualifies for up to 24 hours of CPE for CISSP/SSCP holders and 21 hours of CE for CISA/CISM holders. For details, go to www.foundstone.com.

What You'll Learn

Unique in the security training industry, Ultimate Web Hacking will show you not only the latest techniques for exploiting Web-based applications, but also how to defend your organization against these weaknesses. Participants learn CGI, ASP, and Cold Fusion vulnerabilities, as well as exploits such as buffer and input-field overflows. Hands-on labs reinforce the course material in a real-world environment.

You'll Learn...

Strategic, tactical, and operational countermeasures to prevent hackers from exploiting web-based applications
Security considerations unique to secure web applications
Thorough knowledge of popular web application and infrastructure vulnerabilities including SQL injection, cross-site scripting, authentication/authorization issues, and session management weaknesses
Configuration and usage of web security tools including Nikto, Paros, Brutus, OpenSSL, and SSLDigger

Course Outline

Day 1: Web Technology and Testing Tools

1. Introduction and Example Attacks

2. Preparation and Planning

3. HTTP Overview

HTTP Methods
- HEAD
- GET
- POST
- WebDAV
- Alternate nc Usage
HTTP Headers
- Cookies
- Referer
- User Agent
HTTP Authentication
- Basic
- Digest
- Forms
HTTP Response Codes

4. Profiling the Environment

Profiling Web Server Types
Profiling Application Technology including Cookies, Extensions, URL Patterns & comments
Known Vulnerabilities
SSL
Site Mapping
Spidering and Mirroring Sites with Wget, SpiderZilla, Paros (manual)