Revision as of 10:58, 13 December 2013

Assessing and Exploiting Web Apps with SamuraiWTF by John Sawyer

Course Abstract

Come take the official Samurai-WTF (Web Testing Framework) training course given by one of the founders and lead developers of the project! You will learn the latest Samurai-WTF open source tools and the latest manual techniques to perform an end-to-end penetration test. After a quick overview of pen testing methodology, the instructors will lead you through the process of testing and exploiting web applications, including client side attacks using flaws within the application. We’ll introduce you to the best open source tools currently available, and teach you how these tools integrate with the manual testing techniques. One of the major goals in this course is teaching you the glue that keeps all these techniques and tools together to successfully perform a pentest from beginning to end, which is overlooked in most web pentesting courses.

The majority of the course will be performing an instructor lead, hands-on penetration test. We don’t give you a list of overly simplistic steps to go an do in the corner. Instead, at each stage of the test we present the goals that each testing task is to accomplish and perform pentest along with you on the projector while you are doing it on your own machine. Primary emphasis of these instructor lead exercises is how to integrate these tools into your own manual testing procedures to improve your overall workflow. At the end of course, you will be challenged with a capture the flag event to apply your new skills and knowledge. We will also send you home with several additional vulnerable web apps to practice your new skills at your own pace and experiment with your favorite new tools. This experience will help you gain the confidence and knowledge necessary to perform web application assessments and expose you to the wealth of freely available, open source tools.

Course Objectives

1. Attendees will be able to explain the steps and methodology used in performing web application assessments and penetration tests.
2. Attendees will be able to use the free and open source tools on the Samurai-WTF CD to discover and identify vulnerabilities in web applications.
3. Attendees will be able to exploit several client-side and server-side vulnerabilities.

Course Prerequisites

A basic understanding of web application vulnerabilities and attacks is assumed. This course will focus on use of the tools and their integration into your manual testing procedures, not the theories behind the attacks. This course is designed for novice to intermediate level security professionals, be they developers, managers, or penetration testers.

Resources You Are Responsible to Bring

1. Latest VMware Player, VMware Workstation, VWware Fusion installed. (Other virtualization software such as Parallels or VirtualBox will probably work if the attendee is familiar with its functionality, however VMware Player should be prepared as a backup just in case.)
2. Ability to disable all security software on their laptop such as Antivirus and/or firewalls
3. At least twenty (20) GB of hard drive space
4. At least four (4) GB of RAM

Resources Provided at the Course

1. Power for your laptop
2. Internet connectivity may or may not be available depending on the facility hosting the course
3. ISO of the latest Samurai-WTF release
4. PDF version of the course slide deck

Concepts and Tools Covered

• Samurai-WTF project and distribution
  • About the project
  • Using the Live-DVD
  • Joining the project
• Testing methodology overview
• Introduction to our testing targets
• Reconnaissance techniques and tools
• Hands-on WHOIS and DNS techniques
  • Google hacking and social networks
  • Next Generation Recon
  • Hands-on Recon-ng usage and tricks
• Mapping web applications techniques and tools
  • Hands-on nmap basic and NSE scans for web apps
  • Hands-on nmap optimization for web apps on large networks
  • Hands-on Zenmap usage
  • Hands-on interception proxy usage (Zed Attack Proxy)
  • Hands-on browser proxy and SSL configurations for ZAP
  • Hands-on request/response mapping and baseline techniques
  • Hands-on technology fingerprinting techniques
  • Hands-on functional analysis techniques
  • Hands-on process flow modeling techniques
  • Hands-on FireFox extensions (Wappalyzer, FoxyProxy, Firebug)
• Vulnerability Discovery Techniques and Tools
  • Hands-on default configuration testing techniques
  • Hands-on default configuration scanning (Nikto, ZAP Scan)
  • Hands-on unlinked resource fuzzing (ZAP Force Browse, Raft)
  • Hands-on useragent fuzzing (User Agent Switcher, ZAP Fuzzer)
  • Hands-on unlinked resource fuzzing (DirBuster)
  • Hands-on authentication testing techniques
  • Hands-on account lockout testing (iMacro)
  • Hands-on password fuzzing (ZAP Fuzzer, CeWL)
  • Hands-on session management testing techniques
  • Hands-on session token testing (ZAP TokenGen)
  • Hands-on session token testing (Burp Sequencer)
  • Hands-on authorization testing techniques
  • Hands-on injection testing techniques
  • Hands-on automated vulnerability scanning (ZAP Scanner)
  • Hands-on automated vulnerability scanning (w3af)
  • Business logic testing techniques
  • Denial of service (DOS) testing techniques
  • Hands-on client-side code testing techniques
  • Hands-on flash disassembly (flare)
• Exploitation Techniques and Tools
  • Hands-on session hijacking
  • Hands-on dumping databases via SQL Injection (sqlmap)
  • Hands-on shells via RFI vulnerabilities (Laudanum)
  • Hands-on client side attacks via XSS (BeEF)
• Testing Web Services
  • Hands-on SOAP testing techniques
  • Hands-on reading WSDLs and making SOAP requests (SoapUI)
  • Hands-on fuzzing SOAP requests (ZAP Fuzzer)
• Student Challenge (aka Capture the Flag)
  • Finding flags during mapping
  • Finding flags during discovery
  • Finding flags during exploitation
• Conclusions

23 - 25 April (09:00 - 17:00)

Back to Training Overview