Masterclass:Web Application Pentesting (CQ-WAP)

1. • Module 1: Introduction to Penetration Testing
1. • What is Penetration Testing
2. • Cyber Kill Chain
3. • MITRE ATT&CK Matrix
4. • Testing methodologies 
5. • Reporting
2. • Module 2: Reconnaissance
1. • Open-Source Intelligence (OSINT) 
2. • Google hacking and alternative search engines
3. • Subdomains and DNS enumeration
4. • Public services enumeration
5. • Discovering hidden secrets
3. • Module 3: Introduction to Web Application testing
1. • Modern Web standards and protocols
2. • OWASP TOP 10
3. • Role of web-proxy
4. • Work automatization
5. • Business and logic issues
6. • Supply chain attacks and vulnerable components
7. • Chaining security issues
8. • SSL/TLS issues
9. • Information disclosures
4. • Module 4: Browser's security mechanisms
1. • Introduction to Differences across implementations
2. • Same Origin Policy
3. • CORS and other exceptions
4. • Security headers
5. • Cookies and local storage security
6. • Differences across implementations
5. •  Module 5: Cross Site Scripting
1. •  Reflected and Stored Cross Site Scripting
2. •  Attacking Document Object Model
3. •  DOM clobbering
4. •  Bypassing weak CSP
6. • Module 6: Injections
1. •  Blacklisting vs whitelisting
2. •  SQL injections
3. •  Command injections
4. •  Header splitting and injection
7. • Module 7: Authentication and Authorization
1. •  Attacks on authentication and authorization
2. •  Attacks on sessions
3. •  Insecure Direct Object Reference (IDOR) attacks
4. •  Default credentials
5. •  JSON Web Tokens
8. • Module 8: Insecure file handling
1. •  Path traversal
2. •  Content manipulation
3. •  Insecure file extensions
9. • Module 9: Insecure inclusions
1. • Local File Inclusion
2. •  Remote File
10. • Module 10: Testing API
1. •  OWASP Top 10 for API
2. •  Bypassing API access controls
3. •  Mass assignment attack