Prerequisites-SQL

Lesson 1: Introduction to SQL

Lesson 2: Retrieving Data

Lesson 3: Updating Data

Lesson 4: Inserting Data

Lesson 5: Deleting Data

Lesson 6: Sorting and Filtering Data

Lesson 7: Advanced Filtering

Lesson 8: Summarizing Data

Lesson 9: Grouping Data

Lesson 10: Using Subqueries

Lesson 11: Joining Tables

Lesson 12: Managing Tables

Lesson 13: Using Views

Lesson 14: Stored Procedures

Prerequisites-HTML

Lesson 1: Introduction to HTML5 and Web Design

Lesson 2: How to Create a Simple Web Page

Lesson 3: How to Format Your Text

Lesson 4: Adding Web Links and Images

Lesson 5: Creating Tables

Lesson 6: Forms

Lesson 7: Adding Styles and Classes to Your Web Pages

Lesson 8: Borders, Backgrounds, and Floating Divs

Lesson 9: Building Web Page Layouts with CSS

Lesson 10: HTML5 – What Is It?

Lesson 11: Adding Videos and Graphics with HTML5

Lesson 12: HTML5 and CSS3 – Fonts and Effects

Prerequisites-JavaScript

Variable Naming Rules and JavaScript Data Types

Expressions and Operators

Flow Control

Objects and Arrays

Defining Functions and Methods

Constructors and Inheritance

Pattern Matching with Regular Expressions

JavaScript in Browsers

The Document Object Model (DOM)

How to Get Input and Output

Managing Web Page Styles using JavaScript and CSS

Handling Web Page Events

How to Script Tables

How to Script Forms

Introduction to Ajax

SANS SEC542

• Overview of the web from a penetration tester's perspective
• Web application assessment methodologies
• The penetration tester's toolkit
• WHOIS and DNS reconnaissance
• Open source intelligence (OSINT)
• The HTTP protocol
• Secure Sockets Layer (SSL) configurations and weaknesses
• Interception Proxies
• Proxying SSL through BurpSuite Pro and Zed Attack Proxy
• Heartbleed exploitation

• Target profiling
• Collecting server information
• Logging and Monitoring
• Learning tools to spider a website
• Analyzing website contents
• Brute forcing unlinked files and directories
• Fuzzing
• Web authentication mechanisms
• Username harvesting and password guessing
• Burp Intruder

• Session management and attacks
• Authentication and authorization bypass
• Mutillidae
• Command Injection
• Directory traversal
• Local File Inclusion (LFI)
• Remote File Inclusion (RFI)
• Insecure Deserialization
• SQL injection
• Blind SQL injection
• Error-based SQL injection
• Exploiting SQL injection
• SQL injection tools: sqlmap

• XML External Entity (XXE)
• Cross-Site Scripting (XSS)
• Browser Exploitation Framework (BeEF)
• AJAX
• XML and JSON
• Document Object Model (DOM)
• API attacks
• Data attacks

• Cross-Site Request Forgery (CSRF)
• Python for web app penetration testing
• WPScan
• ExploitDB
• BurpSuite Pro scanner
• Metasploit
• When tools fail
• Business of Penetration Testing:
  • Preparation
  • Methodology
  • Post Assessment and Reporting

SANS SEC552

• Introduction and HTTP basics
  • Managing bug bounty programs
  • Bug hunting tips
  • HTTP review
• Understanding the app
  • Identifying app components
  • Translating business into HTTP requests
  • User profiles and mapping execution path
  • Tracing the data flow
  • Bug bounty case studies
  • Defense perspective
• Hunting for authentication and session flaws
  • Authentication and sessions
  • Parameter identification and session analysis
  • Authentication bypass
    • Parameter manipulation
    • Direct access
    • Bypass multi-factor authentication
  • Bug bounty case studies
  • Defense from authentication and session flaws
• Logic attacks and authorization bypass
  • Authorization and business rules
  • Breaking the business logic
  • Attack techniques:
    • Manipulating parameters
    • Reordering requests
  • Bug bounty case studies
  • Defending from logic attacks
• SQL injection
  • SQL attack techniques based on context
  • Boolean-based SQL injection
  • Time-based SQL injection
  • Bug bounty case studies
  • SQL injection defenses

• Open redirect
  • Open redirect basics
  • Open redirect risk
  • Bug bounty case studies
• Server-side request forgery
  • SSRF basics
  • Discovering SSRF
  • Bug bounty case studies
  • SSRF defenses
• Cross-site request forgery
  • CSRF basics
  • Discovering CSRF
  • Bug bounty case studies
  • CSRF defenses
• Cross-site scripting
  • XSS basics: Reflected, stored, and DOM-based XSS
  • Discovering XSS flaws
  • Tracing the data flow and the context
  • Bug bounty case studies: Tricky stored XSS
  • Filtering detection and bypass
  • Bug bounty case studies: Filter bypass
  • XSS defenses: Input validation and output encoding
• Client-Side code and APIs
  • Client-side code analysis
  • Finding the API URIs
  • Attacking APIs
  • Bug bounty case studies
  • API defenses: Input validation and authorization
• Combining web attacks
  • Successful attack scenarios
  • The art of combining web attacks
  • Open redirect and SSRF
  • Command Injection and CSRF
  • Logic and XSS
  • Bug bounty case studies
• Reporting and responsible disclosure
  • Evidence and proof-of-concept
  • Responsible disclosure
  • Future and practice