Ethical Hacking: Hacking Web Applications

Ethical Hacking: Hacking Web Applications

English | MP4 | AVC 1280×720 | AAC 44KHz 2ch | 4h 49m | 813 MB

Pluralsight is not an official partner or accredited training center of EC-Council. Understanding how to detect and identify risks in your web applications is absolutely critical. This course goes through the risks in depth.

Pluralsight is not an official partner or accredited training center of EC-Council. The security profile of web applications is enormously important when it comes to protecting sensitive customer data, financial records, and reputation. Yet, web applications are frequently the target of malicious actors who seek to destroy these things by exploiting vulnerabilities in the software. Most attacks against web applications exploit well known vulnerabilities for which tried and tested defenses are already well-established. Learning these patterns – both those of the attacker and the defender – is essential for building the capabilities required to properly secure applications on the web today. In this course, we’ll look a range of different security paradigms within web applications both conceptually and in practice. They’ll be broken down into detail, exploited, and then discussed in the context of how the attacks could have been prevented.

Table of Contents

1 Overview
2 The State of Web Application Security
3 Understanding Web Application Security
4 Query Strings, Routing, and HTTP Verbs
5 The Discoverability of Client Security Constructs
6 Protections Offered by Browsers
7 What the Browser Can’t Defend Against
8 What’s Not Covered in This Course
9 Summary
10 Overview
11 Spidering with NetSparker
12 Forced Browsing with Burp Suite
13 Directory Traversal
14 Banner Grabbing with Wget
15 Server Fingerprinting with Nmap
16 Discovery of Development Artefacts with Acunetix
17 Discovery of Services via Generated Documentation
18 Discovering Framework Risks
19 Identifying Vulnerable Targets with Shodan
20 Summary
21 Overview
22 OWASP and the Top 10 Web Application Security Risks
23 Understanding Untrusted Data
24 Parameter Tampering
25 Hidden Field Tampering
26 Mass Assignment Attacks
27 Cookie Poisoning
28 Insecure Direct Object References
29 Defending Against Tampering
30 Summary
31 Overview
32 Reflected Cross Site Scripting (XSS)
33 Persistent Cross Site Scripting (XSS)
34 Defending Against XSS Attacks
35 Identifying XSS Risks and Evading Filters
36 Client Only Validation
37 Insufficient Transport Layer Security
38 Cross Site Request Forgery (CSRF)
39 Summary
40 Overview
41 Understanding Weaknesses in Identity Management
42 Identity Enumeration
43 Weaknesses in the ‘Remember Me’ Feature
44 Resources Missing Access Controls
45 Insufficient Access Controls
46 Privilege Elevation
47 Summary
48 Overview
49 Understanding DoS
50 Exploiting Password Resets
51 Exploiting Account Lockouts
52 Distributed Denial of Service (DDoS)
53 Automating DDoS Attacks with LOIC
54 DDoS as a Service
55 Features at Risk of a DDoS Attack
56 Other DDoS Attacks and Mitigations
57 Summary
58 Overview
59 Improper Error Handling
60 Understanding Salted Hashes
61 Insecure Cryptographic Storage
62 Unvalidated Redirects and Forwards
63 Exposed Exceptions Logs with ELMAH
64 Vulnerabilities in Web Services
65 Summary