Overview

We begin day one with an overview of recent web application attack and security trends, then follow up by examining the essential technologies that are at play in web applications. You cannot win the battle if you do not understand what you are trying to defend. We arm you with the right information so you can understand how web applications work and the security concepts related to them.

We discuss the authentication aspect of web applications in depth. The vulnerability of authentication is covered, followed by examples of exploitation and the mitigations that can be implemented in the short and long term. We complete the discussion by providing information on how to discover and test for vulnerabilities.

Authorization is the last topic of discussion for the day: the goal is to make sure that applications properly control access to the appropriate resources. You will learn the right way to plan for access during the development life cycle and the common pitfalls with access control. Similar to the discussion on authentication, we start with the vulnerabilities and then move on to mitigations and testing, followed by a section on best practices on authorization.

Overview

Since the Internet does not guarantee the secrecy of information being transferred, encryption is commonly used to protect the integrity and secrecy of information on the web. This course day covers the security of data in transit or on disk and how encryption can help with securing that information in the context of web application security.

We continue with a discussion about session management in web applications. We will go over a hacker's technique in attacking the session mechanism and related defense strategies. Best practices of session security will be discussed to ensure your application's session management is as strong as possible. Advanced session topics like cross-site request forgery will also be covered.

Next we will cover business logic flaws and concurrency. These are difficult topics to detect with automated scanners, so it is essential that security professionals understand these problems and avoid them at all costs.

The day ends with analysis of some basic input-related flaws, as well as SQL injection. The basic mechanics of these vulnerabilities are covered, followed by real-world attack trends. Most importantly, we delve into the mitigation of these vulnerabilities and best practices to avoid these critical vulnerabilities.

Overview

Day three begins with a detailed discussion on cross-site scripting and related mitigation and testing strategies, as well as HTTP response splitting.

The code in an application may be totally locked down, but if the server setting is insecure, the server running the application can be easily compromised. Locking down the web environment is essential, so we cover this basic concept of defending the platform and host.

To enable any detection of intrusion, logging and error handling must be done correctly. We will discuss the correct approach to handling incidents and logs, then dive even further to cover the intrusion detection aspect of web application security.

In the afternoon we turn our focus to the proactive defense mechanism so that we are ahead of the bad guys in the game of hack and defend. We will cover such topics such as file upload handling, intrusion detection, honeypot, redirection, extra in-depth authentication information, and practical input validation strategy. The material is designed to give you the extra edge in defending your application.

Overview

Day four is dedicated to the security of asynchronous JavaScript and XML (AJAX) and web services, which are currently the most active areas in web application development. Security issues continue to arise as organizations dive head first into insecurely implementing new web technologies without first understanding them.

We will cover security issues, mitigation strategies, and general best practices for implementing AJAX and web services. We will also examine real-world attacks and trends to give you a better understanding of exactly what you are protecting against. Discussion focuses on the web services in the morning and AJAX technologies in the afternoon.

Overview

Day five focuses on cutting-edge web application technologies and current research area. Topics such as clickjacking and DNS rebinding are covered. These vulnerabilities are difficult to defend and multiple defense strategies are needed for their defense to be successful.

Another topic of discussion is the new generation of single-sign-on solutions such as OpenID. We cover the implications of using these authentication systems and the common "gotchas" to avoid.

With the Web2.0 adoption, the use of Java applet, Flash, ActiveX, and Silverlight are on the increase. The security strategies of defending these technologies are discussed so that these client-side technologies can be locked down properly.

Overview

Day six starts with an introduction to the secure software development life cycle and how to apply it to web development. But the focus is a large lab that will tie together the lessons learned during the week and reinforce them with hands-on applications. Students will be provided with a virtual machine to implement a complete database-driven dynamic website. In addition, they will use a custom tool to enumerate security vulnerabilities and simulate a vulnerability assessment of the website. Students will then have to decide which vulnerabilities are real and which are false positives, and then mitigate the vulnerabilities. The scanner will score the student as vulnerabilities are eliminated or checked off as false positives. Advanced students will be able to extend this exercise and find vulnerabilities not presented by the scanner.

Students will learn through these hands-on exercises how to secure the web application, starting with the operating system, the web server, finding configuration problems in the application language setup, and finding and fixing coding problems in the site.