SEC542: Web App Penetration Testing and Ethical Hacking

Overview

Successful web application penetration testing requires understanding the attacker’s perspective. This course begins with an in-depth look at foundational web technologies, covering protocols, languages, clients, and server architectures. Special emphasis is placed on DNS reconnaissance techniques, including virtual host discovery and analysis of HTTP response headers, cookie security controls, and HTTP methods.

The course leverages the OWASP Web Security Testing Guide (WSTG) methodology to deliver high-quality assessments. Essential tools in a penetration tester’s toolkit are discussed, with a focus on interception proxies like BurpSuite Professional, Zed Attack Proxy (ZAP) and Caido. Students learn how to configure these tools for intercepting SSL traffic and exploring web applications.

Section one also delves into the intricacies of Secure Sockets Layer (SSL) configurations, highlighting common weaknesses. It guides students through target discovery and profiling using tools like cURL, nmap, and testssl.sh to gather configuration details and perform content discovery via spidering/crawling of web applications. Hands-on labs provide practical experience in reconnaissance to identify potential configuration flaws and build a comprehensive profile of each server.

Full Lab Details

• Configuring Interception Proxies
• Configuring Burp Suite License
• Activating the Burp Suite Professional license
• Obtaining the license key from the SANS portal
• Installing and activating the license within Burp Suite on the SEC542 VM
• Setting Up Firefox to Intercept SSL for Burp, ZAP, and Caido
• Importing Burp Pro's Root CA Certificate into Firefox and verifying that it's working
• Importing ZAP's Root CA Certificate into Firefox and verifying that it's working
• Importing Caido's Root CA Certificate into Firefox and verifying that it's working
• Setting Up Access to the SANS ChatGPT Educational Workspace
• Creating a new project in the SANS ChatGPT workspace
• Configuring the project to help ChatGPT decide to assist with pentesting tasks.
• Introducing Interception Proxies
• Objectives:
• Learn common features of interception proxies (Burp Suite Professional and ZAP)
• Solve the "Snake Challenge" by hacking the scoring server of a popular game
• Key Exercises:
• Configuring and using interception proxies effectively
• Identifying and manipulating specific parameters within requests and responses to gain an advantage over security mechanisms
• Tools Showcased: Burp Suite Professional, ZAP, ChatGPT, and WolframAlpha
• Virtual Host Discovery
• Lab Overview:
• Virtual Host Discovery is a key component in finding "hidden" applications on a web server.
• In network-based assessments, discovering virtual hosts can lead to excellent web application penetration testing results.
• The lab focuses on using multiple techniques for discovery, including active DNS queries, DNS zone transfer, online DNS databases, and certificate transparency logs.
• Objectives:
• Discover names that may be associated with virtual hosts in a target environment
• Use multiple techniques for discovery (active DNS queries, DNS zone transfer, online DNS databases, and certificate transparency logs)
• Identify potential web applications or services hosted on the same server as the primary domain
• Key Exercises:
• Perform active DNS queries using the dig command to search records with type "ANY" against target domains
• Attempt a DNS zone transfer for target domains using tools like DNSRecon or Nmap
• Explore online DNS databases such as crt.sh and dnsdumpster.com to discover any current x.509 certificates associated with target domains
• Use brute-forcing methods to uncover additional subdomains using tools like dnsrecon.py and Nmap's dns-brute script
• Analyze Certificate Transparency (CT) logs to identify SSL/TLS-protected virtual hosts
• Tools Showcased: dig, DNSRecon, Nmap, crt.sh, dnsdumpster.com
• Gathering Server Information and Testing HTTPS
• Lab Overview:
• Gathering server information using Nmap NSE scripts
• Testing HTTPS configurations and assessing cipher strength
• Using various tools to analyze website security
• Objectives:
• Leverage Nmap NSE scripts for server information gathering
• Review response headers from within an interception proxy
• Identify outdated components using the Retire.js plugin
• Take screenshots of websites using GoWitness
• Test HTTPS configurations and identify misconfigured certificates, as well as weak protocols and ciphers
• Key Exercises:
• Use Nmap to gather server information and test cipher strength
• Analyze response headers within an interception proxy
• Identify outdated components using the Retire.js plugin
• Take screenshots of websites using GoWitness
• Assess HTTPS configurations and identify weak ciphers
• Compare the security configurations of multiple websites
• Tools Showcased: GoWitness, Nmap, Burp Pro, testssl.sh, Retire.js
• Web Spidering
• Using wget for web spidering
• Discovering accessible and linked application entry points with Burp Suite
• Using Burp Suite's Spider feature to crawl the site
• Analyzing the output for potential entry points or hidden directories
• Verifying discovered URLs manually to confirm accessibility
• Exploring web applications using ZAP
• Launching ZAP and configuring it as an interception proxy
• Setting up the site map in ZAP to discover linked application entry points
• Analyzing traffic patterns and considering potential vulnerabilities
• Building wordlists from web pages using CeWL

Full Topic Details

• Why the Web?
• Web applications are ubiquitous and critical for businesses, but often lack proper security attention; this section explains why understanding their security assessment through penetration testing is essential.
• Application Assessment Methodologies
• Learn how to conduct thorough web application assessments with a focus on finding vulnerabilities within defined scope and testing windows.
• Understand the importance of structured methodologies like the OWASP Web Security Testing Guide (WSTG) for consistent, rigorous, and quality-controlled testing processes.
• Gain insights into building a comprehensive toolkit for effective web application penetration testing, including attack platforms, scanners, browsers, and interception proxies.
• Web Application Pen Tester's Toolkit
• Understand the key components of a web application pen tester’s toolkit, including attack platforms, dynamic web application security scanners, browsers, and interception proxies.
• Interception Proxies
• Gain hands-on experience with interception proxies like ZAP and Burp Suite to intercept, inspect, and manipulate HTTP requests and responses.
• Understand the role of interception proxies in facilitating efficient analysis of web applications, enabling pen testers to identify vulnerabilities that might be overlooked through automated scanning alone.
• HTTP Syntax and Semantics
• Understanding HTTP syntax and semantics is crucial for crafting effective web application penetration test requests that can uncover hidden vulnerabilities.
• Mastery of HTTP request methods such as GET, POST, PUT, DELETE, etc., allows pen testers to identify potential security issues and understand how applications handle different types of data.
• Knowledge of HTTP headers enables targeted testing for weaknesses related to authentication, content type handling, and more, ensuring a comprehensive assessment of web application security.
• Information Gathering
• Learn how to gather critical information about web applications to inform penetration testing efforts, including identifying entry points and potential vulnerabilities.
• Virtual Host Discovery
• Identify and enumerate virtual hosts associated with web servers, a crucial step in understanding the infrastructure behind web applications.
• Target Profiling
• Target profiling is essential for web application penetration testing as it allows pen testers to gather detailed information about the target system’s configuration and technology stack, enabling them to focus their attacks on specific vulnerabilities.
• HTTPS and Testing for Weak Ciphers
• Understanding how to identify and test weak ciphers used in HTTPS communication is crucial for effective web application penetration testing, as it allows for the exploitation of vulnerabilities that could lead to unauthorized access or data interception.
• Content Discovery—Spidering
• Content discovery through spidering is vital in web application penetration testing as it enables pen testers to identify and map out all referenced resources within a target application.

Overview

In this section of the SEC542 Web App Penetration Testing course, students dive into fuzzing, API testing, vulnerability scanning, and major web authentication methods. They are introduced to Burp Suite Professional Scanner and learn how its scanning capabilities help identify real-world vulnerabilities in web applications.

The section opens with fuzzing as a core technique used by both automated scanners and human testers. The instructor demonstrates multiple fuzzing techniques using tools such as the Nuclei Vulnerability Scanner and Burp Suite Pro Scanner, showing how systematically exercising all inputs in a web application uncovers flaws that simple browsing will miss. Students also examine information leakage issues and how leaked data can accelerate the exploitation of other vulnerabilities. They learn the importance of wordlists in contextual scanning, and how carefully chosen, context-specific wordlists can reveal previously undiscovered content and functionality through forced browsing.

Next, the course turns to APIs and their central role in modern web applications. Students explore different approaches to API testing, including hands-on Bruno and OpenAPI labs, and practice identifying and exploiting vulnerabilities within API endpoints. The instructor then surveys key authentication mechanisms such as Basic, Digest, Integrated Windows, and Forms-based authentication, as well as federated identity and access protocols such as SAML, OAuth, and OpenID Connect. The focus is on how these mechanisms work in practice and where common implementation patterns create an attack surface and potential attack vectors, preparing students to recognize weaknesses.

Throughout the section, students work through multiple labs focused on practical skills: fuzzing inputs, running vulnerability scans, performing content discovery through forced browsing, and attacking JSON Web Tokens as a concrete example of authentication-related weaknesses. By the end, they will have gained hands-on experience with fuzzing techniques, vulnerability identification, content discovery, and modern authentication mechanisms and attack surface, providing a solid foundation for deeper web application security testing and penetration methodologies in later sections.

Full Lab Details

• Intro to Fuzzing
• Objectives:
• Gain experience with Burp Intruder
• Understand Intruder positions and payload
• Use Burp to attack the password input of an authentication form
• Key Exercises:
• Seed Burp with a failed login attempt
• Use Burp Intruder to fuzz the password field
• Analyze results and verify successful requests
• Vulnerability Scanning
• Objectives:
• Explore configuration options for Burp Pro’s dynamic scanner
• Identify vulnerabilities in a web application using Burp Suite
• Key Exercises:
• Configure and run a vulnerability scan on a target application
• Review and analyze the results of the scan to identify potential issues
• Tools Showcased: Burp Suite Pro
• ffuf Forced Browse
• Objectives:
• Build upon hosts found via DNS brute forcing
• Discover unlinked content in applications
• Gain hands-on experience with ffuf
• Understand how forced browsing complements crawling/spidering
• Key Exercises:
• Use ffuf to fuzz URLs and discover hidden content on a target application
• Analyze the results of the forced browse to identify new entry points or sensitive information
• Tools Showcased: ffuf
• Bruno/OpenAPI
• Objectives:
• Gain experience interacting directly with APIs
• Work with Bruno
• Use ffuf for API-focused fuzzing
• Utilize Burp Suite Pro for web application security testing
• Key Exercises:
• Import an OpenAPI definition into Bruno
• Perform brute force fuzzing against an API endpoint to discover hidden functionality or vulnerabilities using ffuf
• Integrate and use Burp Suite Pro for additional web application security testing tasks
• Tools Showcased: Bruno, ffuf, Burp Suite Pro
• Flask Session Cookies
• Objectives:
• Explore the technical details of Flask session cookies
• Use flask-unsign to forge a new session cookie with an enhanced role
• Key Exercises:
• Forge a Flask session cookie with an owner role using flask-unsign
• Utilize the forged session cookie to access restricted areas of a web application
• Tools Showcased: flask-unsign, Burp Suite Pro
• Attacking JSON Web Tokens
• Objectives:
• Explore the technical details of JSON Web Tokens (JWT)
• Crack a JWT and recover the signing key using Burp Suite Pro
• Use Burp Suite Pro’s JWT editor to forge a new JWT with an enhanced role
• Key Exercises:
• Utilize Burp Suite Pro to analyze, and John-the-Ripper (JtR) to crack, a sample JWT
• Forge a new JWT with an owner role using Burp Suite Pro’s JWT editor
• Tools Showcased: Burp Suite Pro, JWT Editor, John-the-Ripper (JtR)

Full Topic Details

• Fuzzing
• Students will master the technique of inputting unexpected data into web applications to identify hidden vulnerabilities, learning how to analyze unusual application behavior that could indicate security flaws.
• Information Leakage
• Through this module, students will understand how to detect unintended exposures of sensitive information within web applications, gaining insights into potential security risks and learning strategies for uncovering hidden details that inform attack planning.
• Nuclei Vulnerability Scanner
• Students will learn how to efficiently scan multiple targets using customizable templates with the Nuclei scanner, enhancing their ability to identify vulnerabilities across various web applications quickly and accurately.
• Burp Suite Pro Scanner
• In this module, students will gain comprehensive knowledge of using the Burp Suite Pro Scanner for web application penetration testing, learning active and passive scanning techniques that provide detailed security insights through automated analysis and reporting.
• Content Discovery—Forced Browsing
• Master directory brute-forcing and parameter fuzzing to uncover hidden endpoints that developers never intended to expose, dramatically expanding the attack surface during real engagements.
• APIs
• Students learn to identify and exploit vulnerabilities within APIs using tools like Bruno, enabling them to manipulate backend systems and extract sensitive data.
• Explore a comprehensive range of web services and APIs, including RESTful and SOAP interfaces, GraphQL queries, and OpenAPI specifications.
• Through hands-on labs, students discover how to bypass authentication mechanisms in APIs, allowing them to access restricted functionality and uncover hidden capabilities.
• Authentication
• Students review the intricacies of HTTP Basic, Digest, Integrated Windows, and Form-based authentication.
• Federated Identity and Access Protocols
• Learn how federated identity management mechanisms, such as OAuth, OpenID Connect, and SAML, function within modern applications.
• Students master the intricacies of token-based authentication methods, including JSON Web Tokens (JWT), which are widely adopted in modern web applications for session management and access control.

Overview

This section brings together a full set of labs that walk participants from initial username discovery through advanced client-side exploitation. The labs start with username harvesting, where participants interact with authentication mechanisms and learn to spot cues that reveal valid accounts. Using ZAP and ffuf, they fuzz first initials and last names to build candidate username lists, then use programmatic methods to distinguish legitimate users when differences in HTML responses are visible.

The next lab introduces blind username harvesting and password spraying. Participants refine their techniques for discerning valid usernames even when HTML responses do not differ in obvious ways. They then use Burp Suite Pro to perform password spraying with common passwords and to test for account lockout, reinforcing the connection between username harvesting and later authentication attacks.

Session management is explored through focused work with Burp Suite’s Sequencer tool. Participants analyze session token randomness for an application using strong session identifiers and then compare those results to a simulated set of weak session tokens. Along the way, they review session tamper protection controls and test logout and expiration behavior, seeing how predictable or poorly invalidated tokens can enable unauthorized access.

Authentication and authorization bypass topics build on this foundation. Participants examine flaws such as parameter tampering, direct page access, SQL injection, and session fixation, then turn to authorization weaknesses, including Broken Object Level Authorization and Broken Function Level Authorization. Using Burp Suite, they enumerate valid user accounts with Burp Intruder, determine the uid of a student account, infer another user’s uid from HTTP History, and use Grep Extract to pull usernames from responses, illustrating both vertical and horizontal privilege escalation paths.

The labs then shift to client-side attacks. A set of exercises on stored and reflected Cross Site Scripting introduces a practical methodology for discovering XSS and building proof-of-concept payloads. Participants demonstrate the impact of a stored XSS vulnerability in the Order Lookup flow of the lab target at https://restaurant.sec542.net and use JavaScript to produce specific deliverables for an educational prompt related to credential re-authentication. Additional work on XSS payload construction and delivery shows how XSS can be used to exfiltrate sensitive data by constructing keystroke-capturing payloads with ChatGPT and sending captured data to an out-of-band interaction endpoint such as Burp Collaborator. Participants deliver, and test reflected XSS payloads, analyze the reach and persistence of stored XSS in the Order Lookup feature, and design credential theft style prompts with ChatGPT, using Burp Suite, Collaborator, Python, and ChatGPT as supporting tools.

Finally, the focus moves to DOM-based XSS and browser exploitation. Participants study pure, reflected, and stored DOM XSS variants, craft payloads that use elements such as URL fragments and reflected JSON for client-side injection, and rely on browser developer tools and PortSwigger’s DOM Invader to trace sources, sinks, and execution paths. After testing these payloads in the browser context, they transition to the Browser Exploitation Framework BeEF, explore different XSS payloads, and see how BeEF can redirect browsers, steal credentials, and trigger alerts, tying together the overall impact of client-side vulnerabilities.

Full Lab Details

• Username Harvesting
• Objectives:
• Understand username harvesting techniques
• Use programmatic methods to discern legitimate users
• Discern valid usernames when differences are observable in HTML responses
• Explore advanced features of ffuf
• Key Exercises:
• Fuzz first initials and last names to discover potentially valid usernames using ffuf
• Tools Showcased: ZAP, ffuf
• Blind Username Harvesting and Password Spraying
• Objectives:
• Understand blind username harvesting techniques
• Use programmatic methods to discern legitimate users
• Discern valid usernames when differences are not observable in HTML responses
• Key Exercises:
• Perform blind username harvesting
• Perform password spraying using Burp Suite Pro and common passwords
• Test for account lockout
• Tools Showcased: Burp Suite Pro
• Burp Sequencer: Analyzing Session Tokens
• Objectives:
• Work with Burp’s Sequencer function
• Review analysis results from an application using strong session tokens
• Review analysis results from a simulation of collecting weak session tokens
• Key Exercises:
• Use the Burp Sequencer to analyze the randomness of session token values collected from PHPBB
• Generate a set of insecure session tokens and analyze them with the Sequencer tool
• Tools Showcased: Burp Suite Sequencer
• Authentication Bypass
• Objectives:
• Exploit authentication bypass in an application.
• Use Burp Intruder to enumerate all valid user accounts.
• Key Exercises:
• Determine the uid of the student account and infer the uid of dadams using HTTP History in Burp.
• Use Burp's Grep - Extract to extract usernames from responses.
• Tools Showcased: Burp Suite
• Stored and Reflected XSS
• Objectives:
• Understand the differences between Reflected and Stored Cross Site Scripting.
• Learn how to discover XSS and build a proof-of-concept payload.
• Explore building payloads with ChatGPT to demonstrate the impact of XSS.
• Key Exercises:
• Demonstrate the impact of a Stored XSS in the Order Lookup flow of the lab target (https://restaurant.sec542.net).
• Use JavaScript to produce specific deliverables for an educational prompt related to credential re-authentication.
• Tools Showcased: Burp Suite
• XSS Payload Construction and Delivery
• Objectives:
• Understand how Cross-Site Scripting (XSS) can be used to exfiltrate sensitive data.
• Learn how to construct a JavaScript payload that captures keystrokes and sends them securely to an out-of-band interaction server.
• Practice creating and delivering XSS payloads in a controlled lab environment.
• Key Exercises:
• Deliver and test Reflected XSS payloads.
• Construct a basic XSS payload using ChatGPT that captures keystrokes and sends the data to an out-of-band interaction endpoint such as Burp Collaborator.
• Analyze the impact of a stored XSS vulnerability in an Order Lookup feature, focusing on reach, persistence, and potential data exposure.
• Design an educational proof of concept for a credential theft prompt using ChatGPT.
• Tools Showcased: Burp Suite, Collaborator, Python, ChatGPT
• DOM-Based XSS
• Objectives:
• Understand client-side mechanisms of DOM-based XSS.
• Differentiate between pure, stored, and reflected DOM-XSS variants through hands-on exercises.
• Craft payloads for each type of DOM-XSS, such as using URL fragments for pure XSS or reflected JSON for client-side injection.
• Learn to use browser-based tools like Developer Tools and DOM Invader to discover DOM-XSS vulnerabilities.
• Key Exercises:
• Use the browser’s developer tools and Portswigger’s DOM Invader to analyze source and sink locations, then debug JavaScript to discover DOM-XSS vulnerabilities.
• Test the crafted payload by triggering its execution within the browser context.
• Tools Showcased: Burp Suite, DOM Invader, Browser Developer Tools
• BeEF
• Objectives:
• Become familiar with BeEF and its zombie-controlling awesomeness
• Explore various XSS payloads to cause a variety of impacts
• Learn how to redirect browsers, steal credentials, and trigger alerts using BeEF
• Tools Showcased: Browser Exploitation Framework (BeEF)

Full Topic Details

• Username Harvesting
• Students learn to identify valid usernames through targeted interactions with web application authentication mechanisms, uncovering potential entry points for further exploitation.
• By leveraging username harvesting techniques, students can develop a comprehensive list of candidate usernames, significantly enhancing the efficiency and effectiveness of subsequent password-guessing attacks.
• Session Management
• Students learn to identify predictable session identifiers and review tamper protection controls.
• Explore how to test session expiration and logout mechanisms, ensuring that web applications properly invalidate session IDs when users log out or the session times out.
• Through hands-on exercises with Burp Suite’s Sequencer tool, students analyze session token predictability, identifying vulnerabilities in session management that could lead to unauthorized access and session hijacking.
• Authentication and Authorization Bypass
• This topic examines authentication bypass flaws, including parameter tampering, direct page access, SQL injection, and session fixation.
• It then moves into authorization weaknesses such as Broken Object Level Authorization and Broken Function Level Authorization, along with both vertical and horizontal privilege escalation scenarios.
• DOM
• Brief introduction to the Document Object Model (DOM) and the Same Origin Policy.
• Web Developer Tools
• Overview of built-in browser developer tools.
• Introduction to using PortSwigger’s DOM Invader to inspect and manipulate client-side behavior.
• DOM / Client-Side / AJAX
• Exploration of how JavaScript can modify the DOM in the browser.
• Review of example Asynchronous JavaScript and XML (AJAX) interactions.
• Discussion of Cross-Origin Resource Sharing (CORS) and its impact on client-side security.
• XSS
• Explanation of what Cross-Site Scripting (XSS) is and a practical methodology for discovering it.
• Coverage of the main categories of XSS, with a focus on reflected and stored variants.
• Hands-on exploitation of reflected and stored XSS in the associated lab.
• DOM-Based XSS
• Introduction to pure DOM-based XSS and how it appears in client-side logic.
• Examination of reflected DOM-XSS and stored DOM-XSS as important subcategories.
• Labs where students identify and exploit cases where JavaScript writes user-controlled data into the DOM and triggers script execution.
• The Browser Exploitation Framework
• Use of the Browser Exploitation Framework (BeEF) to execute payloads in hooked browsers.
• Demonstration of how XSS can be leveraged to gain control over victim browsers in real web applications.

Overview

This section immerses students in a series of labs that move from client-side abuse to deep server-side compromise, with a strong focus on real-world data and control impact. It begins with prototype pollution, where students exploit vulnerabilities in JavaScript’s inheritance model to inject malicious properties into objects. Using Burp Suite’s scanner to crawl and audit, they gain hands-on experience manipulating application behavior and even use protocol pollution to submit an approved vacation leave request, illustrating how subtle client-side flaws can drive serious business logic issues.

The focus then shifts to database injection across both SQL and NoSQL technologies. In the error-based SQL injection lab, students manually discover SQL injection flaws, elicit database error messages, and refine their syntax to avoid errors while still achieving data exfiltration, with and without SQL comments. The NoSQL injection lab extends these skills to modern data stores as students identify NoSQL injection vulnerabilities, determine proper NoSQL syntax, and enumerate all entries in a NoSQL database using Burp Suite to support the workflow. Building on this foundation, a combined sqlmap and Burp lab shows how to bypass client-side JavaScript, use Burp’s Active Scanner, and drive automated exploitation with sqlmap. Students manually exploit a SQL injection flaw, steal credit card numbers, dump user-defined hashes, and crack the password of a user with an owner role using John the Ripper, while also leveraging curl and CeWL. Throughout the database injection modules, students learn to use error messages for non-blind SQL injection, apply indirect techniques for blind SQL injection, and explore error based, union based, blind, and out of band database injection categories. They tie this to concrete impact by examining how database injection affects data integrity and confidentiality and how it can be extended to system level command execution and full system compromise, with sqlmap and Burp Suite as primary tooling.

Command injection is addressed in a dedicated sequence of labs and topics. Students practice identifying and exploiting non blind command injection by injecting commands that produce visible output or errors, and they learn to detect blind command injection using techniques such as ping and DNS queries. Burp Collaborator is used to detect blind command injection and exfiltrate data by triggering network requests to collaborator-controlled endpoints. Students also learn to leverage command line symbols such as semicolons and pipes to inject multiple commands on the target system. A lab on command injection combines Burp Suite, Collaborator, Python, and ChatGPT, where students perform command injection against web applications, use Burp features for reconnaissance and exploitation, and build a DNS exfiltration tool with the help of ChatGPT.

The section continues with server-side request forgery and XML external entities. In the SSRF material, students learn to identify and exploit SSRF vulnerabilities by manipulating input parameters that control server-side requests. They see the impact of SSRF in cloud environments where internal resources can be accessed through metadata endpoints and service APIs. Finally, the XXE content and lab give students hands-on experience with XML external entity vulnerabilities, showing how improper XML handling allows reading variables and local files, fetching and displaying remote content, and executing system commands. They learn techniques that include retrieving local files and performing remote code execution via PHP’s expect:// module and differentiate between blind and non-blind XXE attacks, understanding how to infer information or trigger actions even without direct feedback.

Full Lab Details

• Prototype Pollution
• Objectives:
• Gain hands-on experience with Prototype Pollution
• Use Burp's scanner to crawl and audit
• Use protocol pollution to send an approved vacation leave request.
• Tools Showcased: Burp Suite
• Error-Based SQLi
• Objectives:
• Get hands-on experience with SQL injection flaws and attacks
• Manually discover SQLi flaws
• Elicit DB error messages
• Determine proper syntax to avoid errors
• Perform Data exfiltration both with and without employing SQL comments
• Key Exercises:
• Discovering SQL Injection vulnerabilities in a web application
• Exploiting SQL injection to retrieve data
• NoSQLi
• Objectives:
• Get hands-on experience with NoSQL injection flaws and attacks
• Manually discover NoSQLi flaws
• Determine proper NoSQLi syntax
• Enumerate all entries in a NoSQL database
• Key Exercises:
• Discovering NoSQL Injection vulnerabilities in a web application
• Exploiting NoSQL databases for data retrieval and manipulation
• Tools Showcased: Burp Suite
• sqlmap + Burp
• Objectives:
• Bypass client-side JavaScript
• Leverage sqlmap and Burp together to exploit a SQLi flaw
• Use Burp's Active Scanner
• Manually exploit a SQL injection flaw
• Steal credit card numbers via SQL injection
• Dump user-defined hashes via SQL injection
• Crack the password of a user with an owner role with john
• Gain understanding of many sqlmap capabilities
• Key Exercises:
• Using sqlmap and Burp Suite to identify and exploit SQL Injection vulnerabilities
• Leveraging tools like curl, john, and CeWL for further exploitation and cracking
• Tools Showcased: sqlmap, Burp Suite, curl, John the Ripper, and CeWL
• Command Injection
• Objectives:
• Become familiar with inline (visible) and blind command injection attacks
• Use Burp Collaborator to perform blind command injection
• Use Burp Collaborator to exfiltrate data
• Gain experience using ChatGPT to build advanced attack payloads
• Key Exercises:
• Performing command injection attacks on web applications
• Utilizing Burp Suite's features for reconnaissance and exploitation
• Build a DNS Exfiltration tool using ChatGPT
• Tools Showcased: Burp Suite, Collaborator, Python, and ChatGPT
• Server-Side Request Forgery (SSRF)
• Objectives:
• Get familiar with following attack techniques: SSRF, Fuzzing, Analysis of error codes, Authorization bypass, Injection
• Chain multiple vulnerabilities to identify the database and fetch contents of the owner column from the owners table
• Key Exercises:
• Identifying and exploiting Server-Side Request Forgery (SSRF) vulnerabilities in web applications
• Leveraging fuzzing techniques for reconnaissance and vulnerability discovery
• Tools Showcased: Burp Suite, curl, sqlmap
• XML External Entities (XXE)
• Objectives
• Gain hands-on experience with XXE (XML external entities)
• Leverage XXE flaws to read variables and local files, fetch and display remote content, and execute system commands.
• Tools Showcased: Burp Suite, curl

Full Topic Details

• Prototype Pollution
• Students learn to exploit prototype pollution vulnerabilities, manipulating JavaScript’s inheritance model to inject malicious properties into objects, potentially leading to unexpected behavior and security breaches in web applications
• Database Injection
• Students master techniques to identify and exploit SQL injection vulnerabilities by injecting malicious SQL code into web applications.
• They understand the importance of input validation and parameterized queries in preventing SQL injection attacks.
• They discover how to leverage specific database commands and functions in NoSQL environments.
• Database Injection Categories
• They discover how to use error messages from the database to identify non-blind SQL injection vulnerabilities.
• Students explore indirect methods to infer database information through blind SQL injection when no errors are returned.
• Students examine categories of database injection such as error-based, union-based, and blind SQL injection and compare their characteristics.
• They learn out-of-band techniques for database injection that can bypass traditional input validation mechanisms.
• Database Injection Impact
• They understand the impact of database injection on an organization’s data integrity and confidentiality.
• Students explore alternative impact demonstrations that lead to further exploitation opportunities.
• They learn how database injection can be used to execute system-level commands within the database, potentially leading to full system compromise.
• Database Injection Tools
• Students gain hands-on experience with tools like sqlmap and Burp Suite to automate the process of identifying and exploiting database vulnerabilities.
• Command Injection
• Students learn to identify and exploit non-blind command injection vulnerabilities by injecting commands that produce visible output or errors.
• They master techniques for detecting blind command injection using tools like ping and DNS queries to observe system interactions with remote systems.
• Students explore methods to use Burp Collaborator to detect blind command injection by triggering network requests to collaborator-controlled endpoints.
• They understand how to leverage command line symbols (e.g., semicolons, pipes) to inject and execute multiple commands on the target system
• Server-Side Request Forgery
• Students learn to identify and exploit Server-Side Request Forgery (SSRF) vulnerabilities by manipulating input parameters to control server-side requests.
• They explore the impact of SSRF attacks in cloud environments, where internal resources can be accessed through metadata endpoints and service APIs.
• Students discover various exploitation options beyond data retrieval.
• XML External Entities
• Students learn to identify XML External Entity (XXE) vulnerabilities by analyzing web applications for improper handling of XML.
• They master techniques to exploit XXE vulnerabilities, such as retrieving local files and performing remote code execution via PHP’s expect:// module.
• Students differentiate between blind and non-blind XXE attacks, understanding how to infer information or trigger actions without direct feedback in blind scenarios.

Overview

This section brings together advanced web application exploitation techniques with practical scripting and real-world consulting skills. Students begin by investigating an insecure Java deserialization vulnerability. Using Burp Suite and curl, they identify an information leakage issue that exposes local paths, then exploit the Java deserialization flaw with ysomap to steal a secret file. They complete the chain by abusing a file inclusion vulnerability, leaked through the earlier information disclosure, to read the file’s contents. Along the way, they see how insecure deserialization and file inclusion expose sensitive files such as configuration data and source code and how both Local and Remote File Inclusion can lead to remote code execution with the webserver’s privileges.

The section then reinforces automation skills through Python. Students write simple but powerful scripts using the Requests and httpx libraries, reading HTTP response headers and writing them to standard out, and building a basic directory brute forcing script. This supports the broader goal of using Python scripting to automate web application penetration testing, improving efficiency and accuracy in vulnerability discovery. A dedicated Python Pickling lab extends the deserialization theme: students use Burp Suite Professional to analyze an application, scan for vulnerabilities, and review an OpenAPI definition to identify new API paths. They upload and manipulate pickled objects to achieve remote code execution, learning how manipulating serialized data can expose hidden entry points and demonstrate the severe risks of unsecured serialization processes, with Python and Visual Studio Code supporting their workflow.

Server-side template injection is addressed through a focused SSTI lab. Students use Burp’s scanner to audit the website, discover SSTI, and build a proof-of-concept payload. They then demonstrate the impact by accessing the contents of a file on the web server and obtaining remote code execution, directly reflecting the broader topic coverage of server-side template injection and its potential for local file access and code execution.

Cross-Site Request Forgery is tackled through a hands-on CSRF lab using ZAP Proxy. Students gain practical experience with CSRF attacks as they create and execute proof-of-concept code, weaponize a CSRF exploit to change an administrator’s password, and automate exploitation with JavaScript that submits the form for the victim. This ties into the conceptual treatment of CSRF, where they learn techniques to discover CSRF and see how exploitation allows unauthorized actions on behalf of authenticated users, such as transferring funds or modifying settings.

Additional labs and topics expand the view of post-exploitation and professional practice. A file upload and web shell lab has students explore file upload functionality, upload a proof-of-concept payload while circumventing basic controls, and finally upload a web shell to achieve remote code execution using Burp Suite. A Metasploit lab gives hands-on experience with the Metasploit Framework: students navigate msfconsole, exploit a WordPress plugin vulnerability, work with a PHP Meterpreter payload, and save looted files from the compromised target, complementing a high-level module on using Metasploit to demonstrate the impact of public exploits in web applications. Rounding out the section, students consider security logging and monitoring failures, examine issues that lead to logic flaws, learn which items from the OWASP Top 10 for LLM applications matter for web testing, and develop business skills for penetration testing by planning and scoping engagements and turning technical results into impactful reports, executive summaries, and debriefs that support follow-up and continuous improvement.

Full Lab Details

• Insecure Deserialization
• Objectives:
• Investigate a Java Deserialization vulnerability.
• Identify an information leakage vulnerability in the same application that leaks local paths.
• Exploit the identified Java Deserialization vulnerability with ysomap to steal a secret file stored in /secret.txt.
• Read contents of the file by exploiting a file inclusion vulnerability leaked through the previously identified information leakage vulnerability.
• Key Exercises:
• Use Burp Suite and cURL to exploit the identified vulnerabilities.
• Chain all found vulnerabilities to retrieve the contents of a secret file.
• Tools Showcased: ysomap, curl, Burp Suite
• Python
• Objectives:
• Write simple but powerful Python scripts that use the Requests and httpx libraries.
• Use Python to read HTTP Response headers and write them to standard out.
• Write a simple directory brute forcing script.
• Tools Showcased: Python
• Python Pickling
• Objectives:
• Identify and exploit vulnerabilities through manual inspection and automated scanning.
• Understand how to use OpenAPI definitions for API exploration.
• Execute proof-of-concept attacks using Python scripts and HTTP requests.
• Key Exercises:
• Use Burp Pro to analyze an application and scan for vulnerabilities.
• Analyze the OpenAPI definition to identify new API paths.
• Upload and manipulate pickled objects to achieve remote code execution.
• Tools Showcased: Burp Suite Professional, Python, Visual Studio Code
• Server-Side Template Injection (SSTI)
• Objectives:
• Gain hands-on experience with Server-Side Template Injection (SSTI)
• Use Burp's scanner to audit the website
• Discover and exploit SSTI
• Key Exercises:
• Build an SSTI proof-of-concept
• Demonstrate impact of SSTI through accessing the contents of a file on the web server and by obtaining remote code execution.
• Tools Showcased: Burp Suite
• Cross-Site Request Forgery (CSRF)
• Objectives:
• Gain hands-on experience with Cross-Site Request Forgery (CSRF) attacks
• Create and execute a PoC code for a CSRF vulnerability
• Weaponize the CSRF exploit to change admin's password
• Automate the exploitation using JavaScript to submit the form for the victim
• Tools Showcased: ZAP Proxy
• File Upload and Web Shell
• Objectives:
• Explore the file upload function in a web application
• Upload a proof of concept (PoC) payload and circumvent basic file upload controls
• Upload a web shell to the web server and achieve remote code execution
• Tools Showcased: Burp Suite
• Metasploit Lab
• Objectives:
• Gain hands-on experience with Metasploit Framework for application testing
• Learn to navigate msfconsole and use Metasploit to exploit a Wordpress plugin vulnerability
• Work with the PHP Meterpreter payload
• Key Exercises:
• Search for and exploit a matching Wordpress plugin vulnerability using Metasploit
• Save looted files from the compromised target
• Tools Showcased: Metasploit Framework

Full Topic Details

• File Inclusion
• Discover Local and Remote File Inclusion (LFI/RFI) vulnerabilities and see how they expose sensitive files such as configuration data and source code, revealing core application weaknesses.
• Explore how both LFI and RFI can lead to remote code execution, potentially granting full control over the target system with the webserver’s privileges.
• Testing for Insecure Deserialization
• Uncover insecure deserialization vulnerabilities by testing how serialized data is handled, revealing potential entry points for attackers.
• Discover how deserialization flaws can allow attackers to manipulate data or achieve remote code execution.
• Python for Web App Pen Testers
• Students explore Python scripting to automate web application penetration testing, enhancing efficiency and accuracy in vulnerability discovery and providing a powerful toolkit for advanced web app security assessments.
• Python Pickling
• Learn to identify insecure deserialization vulnerabilities by manipulating pickled objects and uncover hidden entry points for attackers.
• Master the impact of data manipulation through Python pickling to achieve remote code execution, demonstrating the severe risks of unsecured serialization processes.
• Server-Side Template Injection
• Discover server-side template injection vulnerabilities and learn how to demonstrate impact through local file access and remote code execution.
• Cross-Site Request Forgery
• Master the techniques to discover Cross-Site Request Forgery (CSRF).
• See how exploiting CSRF flaws allows unauthorized actions on behalf of authenticated users, such as transferring funds or modifying settings.
• Security Logging and Monitoring Failures
• Students consider the goals of logging and monitoring web applications and explore the components of application security observation.
• Logic Flaws
• A brief inspection of the kinds of issues that can lead to logic flaws within web applications.
• OWASP Top 10 for LLM Applications
• Students will learn which of the LLM Top 10 are applicable to web application penetration testing and explore considerations when an LLM is coupled with an application.
• Metasploit Penetration Testing Framework
• This module is a brief, high-level overview of how Metasploit can be effective at demonstrating the impact of public exploits in web applications.
• Business of Penetration Testing: Preparation
• Students learn to plan and scope engagements with detailed schedules, clear scope documents, rules of engagement, and communication plans that align expectations and authorized actions with stakeholders.
• Business of Penetration Testing: Post Assessment
• Students practice turning technical results into impactful reports and executive summaries, delivering effective debriefs for different audiences and supporting follow-up and continuous monitoring for long-term security improvements.