English | MP4 | AVC 1280×720 | AAC 48KHz 2ch | 3h 20m | 367 MB
Building security testing into the software development life cycle is the best way to protect your app and your end users. This course identifies tools and techniques that developers can use to minimize the cost and impact of security testing—while maximizing its impact and effectiveness. In this course, instructor Jerod Brennen focuses on online testing, using security scanning, penetration testing, and vulnerability testing to validate code and uncover vulnerabilities. He explains the difference between positive and negative, manual and automated, and production and nonproduction testing, so you can choose the right kind for your workflow. The hands-on sections—with demos of popular tools such as Fiddler, Burp Suite, and OWASP OWTF—prepare you to apply the lessons in the real world.
Topics include:
- Positive and negative testing
- OWASP Testing Guide
- Manual vs. automated testing
- Scanning vs. pen testing
- Testing in the right environment
- Pen testing a web app
- Evading SIEMs
- Coordinating red and blue teams
- Testing for OWASP Top Ten vulnerabilities
Table of Contents
Introduction
1 The importance of online testing
2 What you should know
Security Testing in QA
3 Software quality assurance process
4 Positive testing
5 Negative testing
6 SQA metrics
7 OWASP Testing Guide
8 Demo OWASP ZAP
Assessing Deployed Apps
9 Manual vs. automated testing
10 Scanning vs. pen testing
11 Testing in non-production
12 Testing in production
13 OSINT gathering
14 Web app proxies
15 Demo Fiddler2
16 Demo Burp Suite
17 Demo Samurai Web Testing Framework (WTF)
Web App Pen Testing
18 Scoping a web app pen test
19 Avoiding production impacts
20 The penetration testing execution standard
21 Types of pen tests
22 Web application firewalls
23 SIEMs
24 Purple teaming
25 Demo OWASP OWTF
Testing for the OWASP Top Ten (2017)
26 The OWASP Top Ten
27 A1 Injection
28 A2 Broken authentication
29 A3 Sensitive data exposure
30 A4 XML external entities (XXE)
31 A5 Broken access control
32 A6 Security misconfiguration
33 A7 Cross-site scripting (XSS)
34 A8 Insecure deserialization
35 A9 Using components with known vulnerabilities
36 A10 Insufficient logging and monitoring
Conclusion
37 Next steps
Resolve the captcha to access the links!