Introduction. Web application technology and evolution

Server-side vulnerabilities. XXE and Command and Code Injections

Server-side Vulnerabilities. Server-side template injections, PHP and Java Deserialization

Information gathering. Fingerprinting and enumeration

Server-side vulnerabilities. SQL Injections

Server-side Vulnerabilities. Server-side request forgery, Business logic flaws

Client-side Vulnerabilities, Client-side and Server-side Cross Site Scripting (XSS)

Client-side vulnerabilities. CSRF, Open redirect, HTML injection

Web application analysis methodology overview. OWASP testing guide, authentication and identity management testing, session management testing, reporting

Secure development lifecycle approaches and methodologies. BSIMM, NIST 800-64 (SSDLC) overview, Threat modelling, risk-based approach

Case Study 1. PHP web application testing

Case Study 2. Java web application testing

Case Study 3. .NET web application testing

Case Study 4. Python web application testing

Final exam