SEC542: Web App Penetration Testing and Ethical Hacking

This section introduces web application penetration testing from an attacker’s perspective, emphasizing foundational web technologies, DNS reconnaissance, and HTTP protocol security. It covers essential tools like BurpSuite Pro and ZAP for intercepting traffic, as well as methodologies such as the OWASP assessment framework.

This section introduces techniques like fuzzing, vulnerability scanning, and forced browsing to uncover hidden content and potential vulnerabilities. It also explores authentication, authorization, and session management mechanisms—covering common attack vectors and tools like BurpSuite, ZAP, and ffuf.

This course section focuses on identifying and exploiting critical vulnerabilities such as authentication and authorization bypasses, injection flaws, and insecure deserialization. Emphasizing manual testing techniques, students gain hands-on experience with command injection, file inclusion, and various forms of SQL injection.

This section focuses on advanced injection flaws, highlighting various forms of XSS and introducing tools like BeEF for browser exploitation. It also explores API and data attacks through REST, SOAP, and AJAX, and concludes with practical labs on complex vulnerabilities like SSRF and XXE, emphasizing the chaining of exploits and client-side analysis.

This section teaches how to escalate access, pivot within networks, and understand the broader business impact of vulnerabilities. We cover advanced techniques using tools like Metasploit and Nuclei, explore logging and monitoring, and introduce LLM-specific vulnerabilities – ending with a hands-on challenge on manual exploitation and custom tool adaptation.

During section six, students form teams and compete in a web application penetration testing tournament.