Attacking and Securing Java / JEE Web Applications (TT8320-J)

This course begins by developing the skills required to fingerprint a web application and then scan it for vulnerabilities and bugs. In this course you will learn about: 

· Ensure that any hacking and bug hunting is performed in a safe and appropriate manner

· Identify defect/bug reporting mechanisms within their organizations

· Setup and use various tools and techniques to determine a web application’s operational environment

· Setup and use various tools and techniques to enumerate all aspects of a web application

· Setup and use various tools and techniques to scan a web application for vulnerabilities

· Work with specific tools for targeted vulnerabilities

· Avoid common mistakes that are made in bug hunting and vulnerability testing

· Understand the concepts and terminology behind defensive, secure coding including the phases and goals of a typical exploit

· Develop an appreciation for the need and value of a multilayered defense in depth

· Understand potential sources for untrusted data

· Understand the consequences for not properly handling untrusted data such as denial of service, cross-site scripting, and injections

· To test web applications with various attack techniques to determine the existence of and effectiveness of layered defenses

· Prevent and defend the many potential vulnerabilities associated with untrusted data

· Understand the vulnerabilities of associated with authentication and authorization

· Detect, attack, and implement defenses for authentication and authorization functionality and services

· Understand the dangers and mechanisms behind Cross-Site Scripting (XSS) and Injection attacks

· Detect, attack, and implement defenses against XSS and Injection attacks

· Understand the risks associated with XML processing, file uploads, and server-side interpreters and how to best eliminate or mitigate those risks

· Learn the strengths, limitations, and use for tools such as code scanners, dynamic scanners, and web application firewalls (WAFs)

· Understand techniques and measures that can used to harden web and application servers as well as other components in your infrastructure