Web Application Hacker’s Handbook

Presented By: MDSec (Marcus Pinto)
The Web Application Hacker’s Handbook (WAHH) Series is the most deep and comprehensive general purpose guide to hacking web applications that is currently available. This course is a practical opportunity to take the skills and theory taught in the book to the next level, experimenting with all of the tools and techniques against numerous vulnerable web applications and labs, under the guidance of the book’s authors. The course also includes new material from the second edition of WAHH, bringing the course right up to date with the latest attacks.

The 2 day course will take place on the 8th & 9th September 2015, before 44CON London 2015.

Course Syllabus
The course follows the contents of WAHH, with a strong focus on practical techniques:

Overview of web application security (chapters 1-3)
Mapping the application and its attack surface (chapter 4)
Bypassing client-side controls (chapter 5)
Attacking core security mechanisms: authentication, session handling, access controls (chapters 6-8)
Using automation to enhance manual testing (chapter 13)
Injecting code and other input-based attacks (chapters 9-10)
Attacking application logic (chapter 11)
Attacking other users (chapter 12)
We will cover a huge range of attacks and techniques, including:

Injection into SQL, XML, LDAP, XPath, SOAP and other back-end contexts
The nuances of SQL injection against Oracle, MySQL and MSSQL
Finding and exploiting subtle flaws in authentication mechanisms
Exploiting seemingly “low risk” issues to achieve full application compromise
Getting the most out of Burp Suite and other tools
Turning theoretical attacks into practical exploits
The latest attack techniques which have been developed in recent months
And much more …

The course employs a range of demo applications and lab exercises, containing hundreds of different examples of web application vulnerabilities.

Student Requirements
Delegates should be able to meet the following:

Familiarity using an intercepting proxy
Understanding of basic concepts such as the HTTP protocol, session management, and basic HTML.
Computers capable of running Burp Suite (www.portswigger.net). Note that attendees should have administrative access on these machines in order to set IP addresses, modify hosts files and install software.
What to Bring
A version of the JRE, capable of running Burp Suite.

An Ethernet connection.

Administrative access to the laptop, and the ability to install a few tools, and disable personal firewalls or virus scanners should they get in the way of the lab exercises.

We strongly recommend a personal laptop – if your corporate laptop build is too restrictive this may affect your ability to participate in the course fully.

About the Trainer
Marcus Pinto is internationally recognised as a leader in the application and database security field, having spent the last nine years in Information Security both as a consultant and as an end user responsible for a global team securing over 200 build tracks and 50+ externally facing applications. He has delivered training to some of the most high-profile audiences, at 44CON, BlackHat, SyScan, and Hack in the Box. Privately he has run training for many technical audiences including CESG’s penetration testing team.

Marcus also sat on the assessors panel providing input for the CREST Web Application Exam, the UK’s number one certification for application assessment.