Advanced Web Application Penetration Testing [Arabic]

الكورس ده معمول للي عايز يفهم ويكسر الويب بجد، مش يحفظ تشيك ليست وخلاص. هنشتغل بعقلية الـ Real Attacker ونغطي الهجمات القديمة اللي لسه شغالة، والحديثة اللي بتعدّي من تحت الرادار.

: محتوى الكورس

- Injection Attacks

- SQL Injection (Classic – Blind – Error-Based – Time-Based)

- NoSQL Injection

- Command Injection

- SSTI

- XPath & LDAP Injection

- Authentication & Authorization Testing

- Login & Signup Flaws

- Password Reset Attacks

- Session Management Issues

- JWT Attacks (None, Weak Secret, Algorithm Confusion)

- OAuth Misconfigurations

- Broken Access Control (IDOR / BFLA / BOLA)

- HTTP Attacks & Core Web Weaknesses

HTTP Request Smuggling

Host Header Injection

HTTP Parameter Pollution

Cache Poisoning

Verb Tampering

Modern Web Attacks

Business Logic Attacks

Race Conditions

Webhooks Abuse

File Upload Exploitation (Advanced Techniques)

DOM-based Attacks

SSRF

Basic & Blind SSRF

Cloud Metadata Exploitation

Internal Network Pivoting

SSRF to RCE Scenarios

Insecure Deserialization

Java / PHP / JSON Deserialization

Gadget Chains Concept

From Object Injection to RCE

Real-world Exploitation Logic

API Security

REST API Attacks

Broken Object Level Authorization

Mass Assignment

Improper Rate Limiting

Token Abuse

API Recon & Enumeration

GraphQL Security

GraphQL Introspection Abuse

Query Complexity Attacks

Authorization Bypass

GraphQL Injection

WAF Evasion Techniques

Payload Obfuscation

Encoding Tricks

HTTP Smuggling for Bypass

WAF Fingerprintin

Disclaimer:

This course is an independent and unofficial educational product. It is not affiliated with, endorsed, sponsored, or approved by INE or any certification provider. All trademarks and certification names mentioned are the property of their respective owners.