We can host this training at your preferred location. Contact us!

2-Day hands-on AppSec training covering the most common application security vulnerabilities and how to build secure applications that avoid these issues. Finding security vulnerabilities at the end of the SDLC is often too late to influence fundamental changes in the way the code is written, and many security issues could be avoided from the outset.

This class has been written by developers turned pen testers who can help developers to code in a secure manner and introduce security into the development cycle. Throughout this class, developers will be able to get on the same page with security professionals, understand how exploitable vulnerabilities are created in code, learn how to fix or mitigate vulnerabilities and get acquainted with the root causes behind some real-world breaches. Various bug bounty case studies from popular websites like Facebook, Google, Shopify, Paypal, Twitter etc will be discussed explaining the financial repercussions of application security vulnerabilities like SSRF, XXE, SQL Injection, Authentication issues etc.

The techniques discussed in this class are generic and developers from any language background can easily grasp and implement the knowledge learned within their own environments. In the class, .NET, Java and NodeJS are used in the workshop examples as this range provide lessons that can be used in a wide range of applications.

Students will also participate in a ‘capture the flag’ exercise where they’ll be challenged to identify vulnerabilities in code snippets derived from real-world applications.

Learn to code more securely and build more secure applications.
Identify and fix security vulnerabilities much earlier in the SDLC process saving time and effort.
Understand OWASP Top 10 common application vulnerabilities with practical demonstrations and deeper insight.
Understand the financial and wider repercussions of different vulnerabilities.
Get on the same page with the security team while discussing vulnerabilities.

Application Security Basics

Why do we need Application Security?
Understanding OWASP TOP 10

Understanding the HTTP Protocol

Understanding HTTP/HTTPS protocol
- Lab: Configure Burpsuite to intercept HTTP/HTTPS traffic
Understanding Requests and Responses
- Lab: Manipulating HTTP headers
- Demo: Host Header Injection
- Mitigation Techniques
Attack Surface detection

Security Misconfigurations

Common misconfigurations in Web Applications
Sensitive Information exposure and how to avoid it
Using Softwares with known vulnerabilities
- Demo : Struts2 RCE

Insufficient Logging and Monitoring

Types of Logging
Introduction to F-ELK

Authentication Flaws

Password Complexity
- Lab: Bruteforce using Burpsuite Intruder
Anti-Automation Techniques
- Mitigating brute-force attacks
Password Storage
- Crash Course on Cryptography
- Introduction to HashiCorp Vault
Password Recovery – Best Practices
NoSQL Security
- Lab: Bypass NoSQL Authentication
- Mitigating NoSQL Injections
Understanding WebAuthn – Passwordless Authentication Framework

Authorization Bypass Techniques

Parameter Manipulation
- Common Pitfalls and Mitigations
API Authentication – JWT
- Introduction to JWT
- Lab : Cracking JWT tokens
- Common JWT Attacks
- Mitigating JWT Attacks
SSO Authentication – OAuth
- Introduction to OAuth
- OAuth Flow
- Lab: Bypass OAuth
- Common OAuth Attacks
- Mitigating OAuth Attacks
RBAC Bypasses and mitigations
Mass Assignment Vulnerability
- Understanding Mass Assigning/Auto binding
- Lab: Exploiting Mass Assignment
- Mitigating Mass Assignment vulnerability
Insecure Direct Object References (IDOR)
- Mitigating IDORs
Local file Inclusion (LFI)
- Lab: Download internal files
- Mitigating LFI

Cross-Site Scripting (XSS)

Understanding XSS
Reflected XSS
- Lab: Exploiting Reflected XSS
- Demo: Session Hijacking
Stored XSS
- Lab: Exploiting Stored XSS
How not to Mitigate XSS
- Lab: Pitfalls in XSS Defenses
Mitigating XSS

Cross-Site Request Forgery Scripting

Understanding CSRF
- Lab: Exploiting CSRF
Mitigating CSRF

Server-Side Request Forgery (SSRF)

Understanding SSRF
- Lab: Exploiting SSRF
- SSRF in Cloud
Mitigating SSRF

SQL Injection

Understanding SQL Injection
- Lab: Error-Based SQL Injection
- Lab: Blind SQL Injection
Mitigating SQL Injection
ORM Frameworks

XML External Entity (XXE) Attacks

Understanding XML Entities
Understanding XXE Vulnerability
- Lab: Exploiting XXE Vulnerability
Mitigating XXE

Unrestricted File Uploads

File Upload functionality
- Lab: Uploading webshells
Mitigating File upload vulnerability

Deserialization Vulnerabilities

What is Serialization?
PHP Object Serialization
- Demo: PHP Object Deserialization
- Lab: Exploit PHP Deserialization
Java Object Serialization
- Demo: Java Binary Deserialization
- Other Java Deserialization
Detecting deserialization functions
Mitigation for deserialization vulnerabilities

Client-Side Security Concerns

Understanding Same Origin Policy
Understanding CORS (Cross-Origin Resource Sharing)
- Demo: CORS
- Excessive CORS
Transport Layer Protection: HSTS
Securing Cookies
Iframe Security
- Demo: Clickjacking
Content-Security Policy
Referrer Policy

Source Code Review

Manual Code Review
- SQL Injection
- Identify vulnerable libraries
- Identify Authorization Flaws
- Log Injections
- File Handling
- Insecure Cryptography
Automated Code Review
- Demo: FindSecBugs/CAT.NET
Secure Code Review CTF

DevSecOps

DevSecOps - What Why and How?
DevSecOps Sample Implementation

Why have you chosen us?

I have attended a training from Bilginc IT Academy before and I was satisfied.

I have attended a training from a different provider and it was not helpful.

Other

How many employees do you have in your IT department?

0 – 50

50 – 250

250 – 1000

1000+

Application Security for Developers Training Course in Norway

The Nordic country Norway, is in Northern Europe. Known for its stunning natural beauty, including fjords, mountains, and forests, Norway is also famous for its high standard of living and strong social welfare system. Norway's capital and largest city is Oslo. Tromsø, Bergen, Trondheim and Stavanger are the other tourist attracting cities of Norway.

Norway is a constitutional monarchy with King Harald V as the head of state. The country has a population of 5,425,270 as of January 2022. Norway is a relatively small country and has a relatively low population density, with much of its land area covered by forests, mountains, and fjords. Despite its small size, Norway is known for its rich cultural heritage, strong economy, and stunning natural beauty, which attracts millions of visitors every year. This Nordic country is also known for its winter sports, such as skiing and snowboarding, and is a popular destination for outdoor enthusiasts.

Norway has a long history of invention and is home to numerous more top-tier tech firms and research facilities, such as; Kongsberg Gruppen, Telenor, Atea, Evry and Gjensidige Forsikring.

Due to the country's high latitude, there are large seasonal variations in daylight. From late May to late July, the sun never completely descends beneath the horizon. Which attracts many tourists around the world to see the "Land of the Midnight Sun". Tourists mainly visit Sognefjord, Norway's Largest Fjord, Pulpit Rock, one of the most photographed sites in Norway and of course the capital; Oslo.

Oslo is considered the business center of Norway. It is the country's largest city and the capital of Norway. The city is home to many of Norway's largest and most important companies, as well as several international organizations and research institutions. Additionally, the city is a popular tourist destination, known for its scenic location on the Oslo Fjord, its many museums and cultural attractions, and its vibrant nightlife and dining scene. Some of the most popular museums in Oslo are The Norwegian Museum of Cultural History, The Nobel Peace Center, The National Museum of Art, Architecture, and Design, The Munch Museum and The Vigeland Museum.

Application Security for Developers Training in Norway

Upcoming Trainings

Related Trainings

Application Security for Developers Training in Norway

What You Will Learn

Outline

FREE CYBER SECURITY RESOURCES FOR REMOTE WORKERS!

Upcoming Trainings

Related Trainings