We can host this training at your preferred location. Contact us!

2-Day hands-on AppSec training covering the most common application security vulnerabilities and how to build secure applications that avoid these issues. Finding security vulnerabilities at the end of the SDLC is often too late to influence fundamental changes in the way the code is written, and many security issues could be avoided from the outset.

This class has been written by developers turned pen testers who can help developers to code in a secure manner and introduce security into the development cycle. Throughout this class, developers will be able to get on the same page with security professionals, understand how exploitable vulnerabilities are created in code, learn how to fix or mitigate vulnerabilities and get acquainted with the root causes behind some real-world breaches. Various bug bounty case studies from popular websites like Facebook, Google, Shopify, Paypal, Twitter etc will be discussed explaining the financial repercussions of application security vulnerabilities like SSRF, XXE, SQL Injection, Authentication issues etc.

The techniques discussed in this class are generic and developers from any language background can easily grasp and implement the knowledge learned within their own environments. In the class, .NET, Java and NodeJS are used in the workshop examples as this range provide lessons that can be used in a wide range of applications.

Students will also participate in a ‘capture the flag’ exercise where they’ll be challenged to identify vulnerabilities in code snippets derived from real-world applications.

Learn to code more securely and build more secure applications.
Identify and fix security vulnerabilities much earlier in the SDLC process saving time and effort.
Understand OWASP Top 10 common application vulnerabilities with practical demonstrations and deeper insight.
Understand the financial and wider repercussions of different vulnerabilities.
Get on the same page with the security team while discussing vulnerabilities.

Application Security Basics

Why do we need Application Security?
Understanding OWASP TOP 10

Understanding the HTTP Protocol

Understanding HTTP/HTTPS protocol
- Lab: Configure Burpsuite to intercept HTTP/HTTPS traffic
Understanding Requests and Responses
- Lab: Manipulating HTTP headers
- Demo: Host Header Injection
- Mitigation Techniques
Attack Surface detection

Security Misconfigurations

Common misconfigurations in Web Applications
Sensitive Information exposure and how to avoid it
Using Softwares with known vulnerabilities
- Demo : Struts2 RCE

Insufficient Logging and Monitoring

Types of Logging
Introduction to F-ELK

Authentication Flaws

Password Complexity
- Lab: Bruteforce using Burpsuite Intruder
Anti-Automation Techniques
- Mitigating brute-force attacks
Password Storage
- Crash Course on Cryptography
- Introduction to HashiCorp Vault
Password Recovery – Best Practices
NoSQL Security
- Lab: Bypass NoSQL Authentication
- Mitigating NoSQL Injections
Understanding WebAuthn – Passwordless Authentication Framework

Authorization Bypass Techniques

Parameter Manipulation
- Common Pitfalls and Mitigations
API Authentication – JWT
- Introduction to JWT
- Lab : Cracking JWT tokens
- Common JWT Attacks
- Mitigating JWT Attacks
SSO Authentication – OAuth
- Introduction to OAuth
- OAuth Flow
- Lab: Bypass OAuth
- Common OAuth Attacks
- Mitigating OAuth Attacks
RBAC Bypasses and mitigations
Mass Assignment Vulnerability
- Understanding Mass Assigning/Auto binding
- Lab: Exploiting Mass Assignment
- Mitigating Mass Assignment vulnerability
Insecure Direct Object References (IDOR)
- Mitigating IDORs
Local file Inclusion (LFI)
- Lab: Download internal files
- Mitigating LFI

Cross-Site Scripting (XSS)

Understanding XSS
Reflected XSS
- Lab: Exploiting Reflected XSS
- Demo: Session Hijacking
Stored XSS
- Lab: Exploiting Stored XSS
How not to Mitigate XSS
- Lab: Pitfalls in XSS Defenses
Mitigating XSS

Cross-Site Request Forgery Scripting

Understanding CSRF
- Lab: Exploiting CSRF
Mitigating CSRF

Server-Side Request Forgery (SSRF)

Understanding SSRF
- Lab: Exploiting SSRF
- SSRF in Cloud
Mitigating SSRF

SQL Injection

Understanding SQL Injection
- Lab: Error-Based SQL Injection
- Lab: Blind SQL Injection
Mitigating SQL Injection
ORM Frameworks

XML External Entity (XXE) Attacks

Understanding XML Entities
Understanding XXE Vulnerability
- Lab: Exploiting XXE Vulnerability
Mitigating XXE

Unrestricted File Uploads

File Upload functionality
- Lab: Uploading webshells
Mitigating File upload vulnerability

Deserialization Vulnerabilities

What is Serialization?
PHP Object Serialization
- Demo: PHP Object Deserialization
- Lab: Exploit PHP Deserialization
Java Object Serialization
- Demo: Java Binary Deserialization
- Other Java Deserialization
Detecting deserialization functions
Mitigation for deserialization vulnerabilities

Client-Side Security Concerns

Understanding Same Origin Policy
Understanding CORS (Cross-Origin Resource Sharing)
- Demo: CORS
- Excessive CORS
Transport Layer Protection: HSTS
Securing Cookies
Iframe Security
- Demo: Clickjacking
Content-Security Policy
Referrer Policy

Source Code Review

Manual Code Review
- SQL Injection
- Identify vulnerable libraries
- Identify Authorization Flaws
- Log Injections
- File Handling
- Insecure Cryptography
Automated Code Review
- Demo: FindSecBugs/CAT.NET
Secure Code Review CTF

DevSecOps

DevSecOps - What Why and How?
DevSecOps Sample Implementation

Application Security for Developers Training Course in Finland

Finland is a country located in northern Europe. Helsinki is the capital and largest city of the country. The majority of the people are Finns but there is also a small Lapp population in Lapland, where the country is famous for the Northern Lights. Finland's national languages are Finnish and Swedish.

Known for its vast forests, lakes, and natural beauty, Finland is one of the world's largest producers of forest products, such as paper, pulp, and lumber. One of the world's largest sea fortresses Suomenlinna, Rovaniemi with the "White Nights", dogsled safaris and of course the Northern Lights are what makes Finland so popular for tourists. Finland is one of the best places in the world to see the Northern Lights and attracts millions of tourists during its seasons.

Finland is home to a thriving technology industry and is widely recognized as one of the world's leading technology hubs. Companies such as Nokia and Rovio (creator of the popular game Angry Birds) are based in Finland. Some of the key factors that have contributed to Finland's success in technology include; strong investment in research and development, a highly educated workforce and fundings.

Finland has a strong educational system, and is widely regarded as one of the world's most literate countries. In fact, Finland's literacy rate is one of the highest in the world, and its students consistently perform well in international tests of math and reading ability.

Also, as a pioneer in environmental sustainability, Finland is known for its efforts to reduce its carbon footprint and promote clean energy. This Nordic country is also famous for its unique and distinctive cultural heritage, including its traditional folk music and its elaborate traditional costumes.

Helsinki, Finland's capital city, is the country's business center. Helsinki is Finland's largest city, and it is home to many of the country's major corporations and organizations, including many of the country's leading technology firms. The city is also a commercial, trade, and financial center, as well as one of the busiest ports in the Nordic region.

Take advantage of our diverse IT course offerings, spanning programming, software development, business skills, data science, cybersecurity, cloud computing and virtualization. Our knowledgeable instructors will provide you with practical training and industry insights, delivered directly to your chosen venue in Finland.

Application Security for Developers Training in Finland

Upcoming Trainings

Related Trainings

Application Security for Developers Training in Finland

What You Will Learn

Outline

FREE CYBER SECURITY RESOURCES FOR REMOTE WORKERS!

Upcoming Trainings

Related Trainings