Pentesting de Aplicaciones Web – Avanzado I (24 Hrs)
|
DETALLE DEL CURSO:
/ A1 -Injection /• HTML Injection -Reflected (GET) • HTML Injection -Reflected (POST) • HTML Injection -Reflected (Current URL) • HTML Injection -Stored (Blog) • iFrame Injection • LDAP Injection (Search) • Mail Header Injection (SMTP) • OS Command Injection • OS Command Injection -Blind • PHP Code Injection • Server-Side Includes (SSI) Injection • SQL Injection (GET/Search) • SQL Injection (GET/Select) / A2 -Broken Auth. & Session Mgmt. /• Broken Authentication -CAPTCHA Bypassing • Broken Authentication -Forgotten Function • Broken Authentication -Insecure Login Forms • Broken Authentication -Logout Management • Broken Authentication -Password Attacks / A3 -Cross-Site Scripting (XSS) /• Cross-Site Scripting -Reflected (GET) • Cross-Site Scripting -Reflected (POST) • Cross-Site Scripting -Reflected (Back Button) • Cross-Site Scripting -Reflected (Custom Header) • Cross-Site Scripting -Reflected (Eval) • Cross-Site Scripting -Reflected (HREF) • Cross-Site Scripting -Reflected (Login Form) • Cross-Site Scripting -Reflected (phpMyAdmin) • Cross-Site Scripting -Stored (Blog) • Cross-Site Scripting -Stored (Change Secret) • Cross-Site Scripting -Stored (User-Agent) / A4 -Insecure Direct Object References /• Insecure DOR (Change Secret) • Insecure DOR (Reset Secret) / A5 -Security Misconfiguration /• Arbitrary File Access (Samba) • Cross-Domain Policy File (Flash) • Denial-of-Service (Large Chunk Size) • Denial-of-Service (Slow HTTP DoS) • Denial-of-Service (SSL-Exhaustion) • Local Privilege Escalation (sendpage) • Local Privilege Escalation (udev) • Man-in-the-Middle Attack (HTTP) • Robots File / A6 -Sensitive Data Exposure /• Base64 Encoding (Secret) • BEAST/CRIME/BREACH Attacks • Clear Text HTTP (Credentials) • HTML5 Web Storage (Secret) • Text Files (Accounts) / A7 -Missing Functional Level Access Control /• Directory Traversal -Directories • Host Header Attack (Cache Poisoning) • Host Header Attack (Reset Poisoning) • Local File Inclusion (SQLiteManager) • Remote & Local File Inclusion (RFI/LFI) • Restrict Device Access / A8 -Cross-Site Request Forgery (CSRF) /• Cross-Site Request Forgery (Change Password) • Cross-Site Request Forgery (Change Secret) / A9 -Using Known Vulnerable Components /
• Buffer Overflow (Local) • Buffer Overflow (Remote) • Drupal SQL Injection (Drupageddon) • PHP CGI Remote Code Execution • PHP Eval Function • SQLiteManager PHP Code Injection / A10 -Unvalidated Redirects & Forwards /• Unvalidated Redirects & Forwards (1) • Unvalidated Redirects & Forwards (2) |
Pentesting to Web Services (24 Hrs)
|
DETALLE DEL CURSO:
Tema 1. Atacando Web Services
• Que son los Web Services?• Entendiendo XML • Entendiendo SOAP • SOAP HTTP binding • Entendiendo WSDL Tema 2. Arquitectura de Web Services
• Arquitectura de Web ServicesTema 3. Ataques a Servicios Web (DVWS)
• Divulgacion WSDL• Enumeracion de WSDL • XML Bomb Denial-of-Service • XML External Entity Processing • XPATH Injection • Command Injection • Cross Site Tracing (XST) • Server Side Request Forgery (SSRF) • REST API SQL Injection • XML External Entity • JSON Web Token (JWT) Secret Key Brute Force Tema 4. Web Services con WebGoat
• Create SOAP Request• WSDL Scanning • Web Services SAX Injection • Web Services SQL Injection • Same Origin Policy Protection • DOM-Based Cross Site Scripting • XPATH Injection Attack |
Pentesting de Aplicaciones Web – Avanzado II (24 Hrs)
|
DETALLE DEL CURSO:
/ A1 -Injection /
• SQL Injection (POST/Search) • SQL Injection (POST/Select) • SQL Injection (AJAX/JSON/jQuery) • SQL Injection (CAPTCHA) • SQL Injection (Login Form/Hero) • SQL Injection (Login Form/User) • SQL Injection (SQLite) • SQL Injection (Drupal) • SQL Injection -Stored (Blog) • SQL Injection -Stored (SQLite) • SQL Injection -Stored (User-Agent) • SQL Injection -Stored (XML) • SQL Injection -Blind -Boolean-Based • SQL Injection -Blind -Time-Based • SQL Injection -Blind (SQLite) • SQL Injection -Blind (Web Services/SOAP) • XML/XPath Injection (Login Form) • XML/XPath Injection (Search) / A2 -Broken Auth. & Session Mgmt. /
• Broken Authentication -Weak Passwords • Session Management -Administrative Portals • Session Management -Cookies (HTTPOnly) • Session Management -Cookies (Secure) • Session Management -Session ID in URL • Session Management -Strong Sessions / A3 -Cross-Site Scripting (XSS) /
• Cross-Site Scripting -Reflected (JSON) • Cross-Site Scripting -Reflected (AJAX/JSON) • Cross-Site Scripting -Reflected (AJAX/XML) • Cross-Site Scripting -Reflected (AJAX/XML) • Cross-Site Scripting -Reflected (PHP_SELF) • Cross-Site Scripting -Reflected (Referer) • Cross-Site Scripting -Reflected (User-Agent) • Cross-Site Scripting -Stored (Cookies) • Cross-Site Scripting -Stored (SQLiteManager) / A4 -Insecure Direct Object References /
• Insecure DOR (Reset Secret) • Insecure DOR (Order Tickets) / A5 -Security Misconfiguration /
• Cross-Origin Resource Sharing (AJAX) • Cross-Site Tracing (XST) • Denial-of-Service (XML Bomb) • Insecure FTP Configuration • Insecure SNMP Configuration • Insecure WebDAV Configuration • Man-in-the-Middle Attack (SMTP) • Old/Backup & Unreferenced Files / A6 -Sensitive Data Exposure /
• Heartbleed Vulnerability • Host Header Attack (Reset Poisoning) • POODLE Vulnerability • SSL 2.0 Deprecated Protocol / A7 -Missing Functional Level Access Control /
• Directory Traversal -Files • Remote & Local File Inclusion (RFI/LFI) • Restrict Folder Access • Server Side Request Forgery (SSRF) • XML External Entity Attacks (XXE) / A8 -Cross-Site Request Forgery (CSRF) /
• Cross-Site Request Forgery (Change Secret) • Cross-Site Request Forgery (Transfer Amount) / A9 -Using Known Vulnerable Components /
• Heartbleed Vulnerability • phpMyAdmin BBCode Tag XSS • Shellshock Vulnerability (CGI) • SQLiteManager Local File Inclusion • SQLiteManager XSS / A10 -Unvalidated Redirects & Forwards /
• Unvalidated Redirects & Forwards (1) • Unvalidated Redirects & Forwards (2) |
API Hacking (24 Hrs)
|
DETALLE DEL CURSO:
Module 1: Introduction to API• What is API/API Centric Applications? • Intro to REST. • REST API Fingerprinting / Fuzzing. • Intro to API Authentication (Basic, JWT, OAuth). Module 1 exercises: • Fingerprinting API. • REST Methods Manipulations. Module 2: Authentication part 1
• Basic Authentication. • Basic Digest Authentication. • Session based vs Token based. • JWT (Json Web Tokens) - Implementation & Attacks. Module 2 exercises: • Crack JWT Secret Key. • Bypass JWT Hash Check. Module 3: Authentication part 2(Authorization)
• OAuth 1, 1.0a, 2 - Standards & Implementation. • Stealing OAuth Access tokens. • CSRF Attack on OAuth. • Attacking authorization code grant flow. • Open Redirect in OAuth. Module 3 exercises: • Steal OAuth tokens. • Attack Authorization Flow. • CSRF Attack on OAuth. Module 4: Other Attacks On API
• DoS attacks on API. • Bruteforcing Attacks. • Attack Development/Staging API’s. • Traditional attacks (XSS, SQLI, IDOR, etc.). Module 4 exercises: • Basic sqli/xss attack on API. • Finding Dev API and use it to bypass protection on production API. |
Copyright 2023 XNET. Todos los derechos reservados.
