CSX Web Application Security Engineer Pathway
OWASP gives students an understanding on how each of these vulnerabilities that puts organizations at risk.
Difficulty: Multilevel CSF Domain: All domains
Continuing Professional Education (CPE) Credit Count: 42
Content
Lesson and Lab Injection
- Understand how systems are vulnerable to injection attacks
- Know the different types of injection attacks
- Understand how to protect from injection attacks
- Identify an injection vulnerability present on a simulated organization’s system of responsibility.
Lesson and Lab Broken Authentication
- Understand what constitutes a broken authentication
- Know how to identify if an application is vulnerable to broken authentication
- Understand how to mitigate and prevent broken authentications
- Identify a broken authentication capability within an organizational application. Once identified, take action to exploit the vulnerability.
Lesson and Lab Sensitive Data Exposure
- Know how to identify sensitive data
- Determine if the information should be exposed or protected
- Understand how to appropriately protect sensitive data
- Enter an environment wherein key organizational data is incorrectly protected. Identify the exposed sensitive data and take steps to protect it from potential misuse
Lesson and Lab XML External Entities
- Understand how threat agents exploit vulnerable XML processors
- Know how to identify if an application is vulnerable to XXE
- Understand how to prevent potential XXE exploitations
- Identify a potential XXE exploitation on a network of responsibility and test the exploit on the vulnerable XML processors.
Lesson and Lab Broken Access Control
- Understand the elements which make broken access control exploitable
- Know how to identify potential access control bypasses
- Understand how to harden access control mechanisms for an organization
- Identify potential broken access mechanisms within the environment, leveraging them to gain access to a system, and then harden the system from additional implementation of the access control.
Lesson and Lab Security Misconfigurations
- Understand the dangers presented with misconfigured systems and networks
- Understand examples of misconfigurations which can make a system vulnerable to exploitation
- Know how to reconfigure certain system applications to increase security
- Identify specific misconfigured applications within a live environment which, when exploited, will give attackers greater influence over a network.
Lesson and Lab Cross-Site Scripting (XSS)
- Understand the different forms of XSS
- Understand how XSS can exploit a user system
- Know how to prevent XSS
- Identify a poorly configured site which performs XSS attacks against user browsers, then implement mechanisms to prevent XSS on an application under their purview.
Lesson and Lab Insecure Deserialization
- Understand the two primary types of deserialization attacks
- Understand which types of applications leverage serialization
- Learn how to prevent deserialization attacks
- Identify applications with potential insecure deserialization vulnerabilities. Take action to test the vulnerability to see if the environment is susceptible.
Lesson and Lab Using Components with Known Vulnerabilities
- Understand characteristics which indication potentially vulnerable applications
- Know the importance of testing for vulnerabilities
- Understand how to prevent potential compromise through implementing proven applications
- Identify applications which are potentially vulnerable to exploitation, take action to address the vulnerabilities and harden the system.
Lesson and Lab Insufficient Logging and Monitoring
- Understand the importance of log monitoring
- Understand how inattentive administrators miss attacks
- Know how to prevent poor logging mechanisms within an infrastructure
- Identify a misconfigured event logger and identify key events which required should have been escalated. Reconfigure the logger to ensure appropriate notification and logging occurs.
Challenge Lab Injection Challenge
- As a web app penetration tester, it will be your responsibility to apply learned skills and techniques in order to complete an injection-based web app security challenge.
Challenge Lab Authentication & Security Misconfiguration Challenge
- Using knowledge from the Broken Authentication (#2) and Security Misconfigurations (#6) labs, complete this final challenge lab!
Lesson Phishing and Browser Exploitation
- Discuss Phishing attacks
- Conduct Phishing examples
Lab/Instructional Browser Attacks
Phishing attacks are the lynchpin of many organizational breaches and exploitations. Cyber security professionals that understand this also understand that many of these attacks are successful due to lack of understanding by end users. This course will teach cyber security professionals how to perform a phishing attack and illustrate the importance of cyber security awareness when browsing the internet.
Lesson and Lab Testing Web Apps
- Discuss cross site script attacks
- Implement a cross site script attack
Part of a comprehensive defense-in-depth implementation includes testing new capabilities and applications before implementing them into an organizations production network. This course illustrates how students can conduct testing against newly developed web applications to ensure they do not pose a risk to organizational assets.
Lab/Instructional SQL Injection
SQL Injection is a common technique used by hackers and red teams to infiltrate database systems via the Web UI. In this lab, we will give student hands-on experience with this type of attack.
Lesson and Lab Data Leakage
- Understand how to start services with XAMPP in order to run DVWA, a web application.
- Understand how to capture packets with Wireshark to expose data leakage within DVWA.
Students will learn the importance of data integrity through comparative analysis of hash algorithm output. Leveraging hashing tools, students will learn how to ensure that data is not compromised post-incident.
Lesson and Lab Session Hijacking
- Configure FireFox to us BurpSuite as a proxy
- Use BurpSuite to intercept client-server requests
- Manipulate a cookies session ID to bypass login
Students will identify web application cookies, interact with Burp, and a MITM attack.
Lesson and Lab DDoS Detection
- Observe and identify a DDoS SYN-Flood attack on a webserver.
- Utilize firewall tools to mitigate future attacks of this type.
Students will experience the different components of a distributed denial of service attack.
Lesson and Lab Chrome Extension
- Utilize Wireshark to isolate client data
- Establish Baseline Data Flows
- Conduct Packet Analysis
- Discover possible nefarious data flow
In early 2018, security researchers discovered several nefarious Chrome extensions that were making unwanted calls to ad servers. This resulted in the removal of these Chrome extensions from the Google Extension Store and a heightened awareness to the possible effects of Chrome extensions on business networks.
Lesson and Lab Harvesting DNS and Focusing Web Searches
- Learn the fundamentals of DNS harvesting and how it applies to the blue team side of cybersecurity
- Grasp the basics of search modifiers
- Use Kali Linux and its command line tools in order to conduct DNS harvesting techniques
- Use Ubuntu Linux and Google Chrome in order to pinpoint web results using search engine directives
Kali Linux has a multitude of command line tools that can be used to harvest DNS information from public servers. As a technical cybersecurity professional, it will be your responsibility to put these tools to use. Also, you will need to use Ubuntu Linux in order to focus your web queries within Google's search engine. In this case, you will be using the Nexus to tie these skills together in order to get familiar with real-world information gathering situations.
Lesson and Lab Investigating HTTP Request Methods
- Learn HTTP, Wireshark and Netcat in order to apply an understanding of HTTP request methods
- Use Kali Linux and Ubuntu Linux in order to properly setup a multi-system LAN
- Use Wireshark in order to analyze the HTTP GET and POST request methods that were previouisly generated
- Use Netcat in order to further analyze how these methods can be used in a CLI
Understanding how website applications are developed is an important skill to have when securing your personal or company website. The back and forth communication between a client and a server can be the difference between a secure web app and a vulnerable one. In this lab, as a website application developer, it is your responsibility to understand how HTTP request methods are used and how it ties in to developing a secure website.