Description

This advanced training course will allow you to enrich your skills to protect yourself and better react to the many threats on the Web. You will see how to audit the security of your applications, test them and implement the most appropriate countermeasures.

Who is this training for ?

Network and system administrators, Webmasters.

Training objectives

Training program

• Reminder of the main security vulnerabilities
  • Cross-Site Scripting (XSS) attack.
  • Command injection and SQL injection.
  • Denial of Service (DoS) attacks.
  • Distributed Denial of Service (DDoS).
  • Buffer overflow.
  • The OWASP project (Open Web Application Security Project).
  • Practical work Setting up a Web server with vulnerabilities to observe its behavior.
  • Demonstration of the exploitation of a buffer overflow.
• Application security
  • Basic concept and importance.
  • The accounts created to carry out the tests.
  • The fictitious folders, can we do without them? The sequences of tests and development are they still present in production?
• Audit and secure a web application
  • Approach and set up an audit.
  • Properly manage interaction with the database.
  • Set up secure authentication.
  • Exploitation of an authentication flaw.
  • Management of errors, exceptions and logs.
  • Know how to analyze and correlate log information .
  • Good practices for having secure forms.
  • Example of using a poorly developed form.
  • Practical work Implementation of a three-tier infrastructure, client, Web server and databases.
  • Simulation of an attempted attack.
  • Analysis and solution.
• Encryption
  • Reminders of the basic principles.
  • Implement encryption in an application.
  • Possible exploitations.
  • Test if an application is well protected by encryption.
  • Encryption applications on the market.
  • Practical work Implementation of a private certification authority with integration of certificates into an application.
• Test applications
  • How to test before putting into production.
  • Fingerprinting: identifying the characteristics of the server (web engine, framework, applications).
  • Using a web spider to detect broken links, pages with or without authentication and encryption.
  • How to measure the availability of an application with a simulation.
  • Practical work Example attempt attacks and fingerprinting.
  • How to write a web spider to detect broken links.
  • Check authentication on pages.