Training Plan

• Introduction to Web app testing
  • OWASP Top 10 Vulnerabilities
  • OWASP Web App Testing Guide
  • Introduction to Proxies
  • Reporting as you go
  • Understanding Workflows
  • Integrating workflows to enhance your pentesting process
• Information Gathering
  • Search Engine discovery and reconnaissance for information leakage
  • Fingerprinting the web server
  • Enumerating applications on the web server
  • Fingerprinting Application and Application Framework
• Configuration and Deployment Management Testing
  • Application Platform Configuration
  • Subdomain Takeover
  • Cloud Storage
• Identity Management Testing
  • Testing for Roles and Privileges
  • Account Enumeration
  • Login Brute Force
  • Default Credentials
  • Weak Username Policy
• Authentication Testing
  • Testing Lockout Mechanisms
  • Bypassing Authentication Schema
  • JWT Attack
  • Testing for Password Reset Functionalities
  • Testing for Authentication in Alternative Channels
  • 2FA Bypass
• Authorization Testing
  • Directory Traversal vulnerabilities
  • Bypassing Authorization Schema
  • Testing for Privilege Escalation
  • Insecure Direct Object References (IDOR)
• Input Validation/Injection Testing
  • SQL Injection vulnerabilities
  • Time-Based SQL Injection
  • Data Exfiltration via Blind OOB SQL Injection
  • XML Injection vulnerabilities
  • Vanilla XXE attack
  • Data Exfiltration via Blind XXE attacks
  • Modern XSS Attacks
  • Host Header Injection
  • SSRF Attacks
  • SSRF on Traditional Web Apps
  • SSRF over Cloud
  • Template Injection Attacks
  • Exploiting File Upload functionalities
  • Deserialization Attacks
• Session Management Testing
  • Testing Logout Functionality
  • Testing for Session Hijacking
  • Testing for Misconfigured Cookie Attributes
• Testing for Weak Cryptography
  • Padding Oracle Attacks
  • Exploiting Weak Encryptions
• Testing for Components with Known Vulnerabilities
  • Attacking PHP Symphony
  • Attacking vulnerable third-party libraries
  • CMS Attacks
  • Log4j
• Business Logic Testing
  • Building models for Business logic Flows
  • Attacking Coupon Functionality / Process Timing Attacks
  • Attacking Payment Gateways
  • Polluting Application Logs
  • Circumventing Workflows