Mastering the OWASP Top 10 Vulnerabilities ~2023

Explore Burp Suite installation and edition options, including community and professional editions, downloads, trial access, and cross-platform compatibility for educational use.

Learn to set up Burp Suite proxy, intercept traffic, use Repeater and Intruder to test requests, and encode or decode payloads to analyze responses.

Investigate real-life authentication vulnerabilities and practice ethical hacking with Burp Suite to perform brute-force and intruder tests, identify valid usernames and passwords, and assess admin access risks.

Explore vulnerable authentication logic through brute force testing on a vulnerable site. Learn how username and password lists, payloads, and intruder tools reveal login weaknesses.

Study broken authentication in the OWASP top 10 through a lab on vulnerable sites, practicing brute-force login simulations and exploring bypass techniques using Burp Suite tools.

Explore directory traversal vulnerabilities through a hands-on lab that teaches how improper file path handling can expose root directories and images, using Burp Suite for interception and testing.

Demonstrate a directory traversal vulnerability by manipulating image parameters with dot-dot-slash to reveal files across root, user, and Etsy/password directories, using burp suite intercept and repeater.

Explore vulnerabilities on a shopping site using proxy tools, intercept traffic and HTTP history, and practice directory traversal concepts to uncover hidden files.

Learn to identify directory traversal vulnerabilities in vulnerable URLs using Burp Suite, image parameters, and manual query parameter manipulation to access images and bypass filters via URL encoding and decoding.

Master the directory traversal vulnerability by mapping and exploiting image file parameters using Burp Suite, intercepting requests, and crafting dot-dot sequences toward the root and etc directories.

Explore directory traversal weaknesses with intercept and repeater, use dot-dot-slash tests, and apply url decoding and encoding to reveal root directories and access sensitive files like /bin/bash.

Explore how to identify and exploit OS command injection vulnerabilities on a vulnerable shopping site using Burp Suite, focusing on reflected parameters, proxy interception, and Linux and Windows command testing.

In lab 01 of mastering the OWASP top 10 vulnerabilities, learn hands-on how manipulating parameters and intercepting requests reveals OS command injection vulnerabilities, using whoami, date, and cat.

Identify OS command vulnerabilities through parameter discovery and practice intercepting, replaying, and injecting commands via product ID and form fields with Burp Suite to reveal server risks.

Explores common OWASP top 10 vulnerabilities by demonstrating OS command injection and directory traversal on a shopping site, using parameter manipulation and intercepting requests to reveal sensitive files.

Solve a common vulnerabilities lab on a vulnerable shopping site by intercepting requests, inspecting parameters, and using out-of-band techniques such as who am I and nslookup to reveal DNS responses.

Identify application logic vulnerabilities in a shopping site and demonstrate price manipulation through request interception and cart modifications.

In this lab, students explore two-factor authentication vulnerabilities on a blogging site, using default credentials and intercepted codes to bypass two-factor authentication through request manipulation and brute-forcing.

Demonstrate a brute-force login attack in a lab, iterating four-digit codes with intercept and intruder payloads to bypass login using default credentials and http status checks.

Explore application logic vulnerabilities in an e-commerce site, demonstrate how price manipulation and product ID changes reveal business logic flaws, and discuss testing with Burp Suite to assess security.

Identify access control vulnerabilities on a target website through hands-on scanning with Kali Linux and GoBuster, revealing home and my account pages, login workflows, and logout behavior.

Identify access control vulnerabilities by scanning the site with go-buster or rb commands, inspecting source code, and testing login protections, including an admin panel that can be viewed without authentication.

Solve lab 3 by identifying access control vulnerabilities through site scanning, enumerating pages including the admin panel, logging in as administrator, and demonstrating deletion of data via intercepting requests.

Investigate admin access control vulnerabilities on a shopping site, bypass login, and access admin panels, view account pages, and test delete actions using Burp Suite tools.

Demonstrates exploiting access control vulnerabilities to retrieve another user's API key. Uses Burp Suite to intercept and tamper requests between login and API access on a two-page site.

Solve access control vulnerabilities in a lab setting on a blogging site. Explore login, account pages, and how user IDs and requests expose API keys.

Explore how error messages disclose server type and version, and practice parameter tampering with Burp Suite to reveal vulnerability details and server responses on a practice shopping site.

Explore how to uncover secret messages on a target website by using proxy interception, sitemap navigation, and phpinfo pages to reveal version details, database info, and a hidden secret key.

Identify information disclosure vulnerabilities by exploring a target site with Burp Suite, intercepting and manipulating requests, discovering hidden pages like robots.txt, backup, and admin pages, and extracting server details.

Explore information disclosure by bypassing local-ip restrictions to access a shopping site's admin panel with burp suite, log in with default credentials, and delete a user.

Explore information disclosure vulnerabilities in the OWASP Top 10 course by scanning target sites with Kali Linux and go-buster to uncover admin pages, login routes, and admin access.

This lecture demonstrates exploiting an upload vulnerability to upload a php shell via avatar upload. It shows using Burp Suite to intercept traffic and verify access on a local host.

examine real-world upload vulnerabilities on a blogging site, learn how image and file uploads can be abused, and see how PHP payloads can reveal restricted data.

Explore upload vulnerabilities on a blogging site, demonstrate uploading web shells through file upload options, and apply path traversal to access restricted content.

Explore the extension bypass method by testing upload options, attempting php uploads, and using alternate extensions to bypass restrictions, illustrating upload vulnerabilities within the OWASP top 10.

Explore upload vulnerabilities in OWASP top 10 contexts, testing image uploads, PHP code execution, and null bytes bypass techniques to access or modify server content.

Learn to identify and mitigate upload vulnerabilities in web applications, including image uploads and metadata manipulation with exiftool, to prevent unauthorized code execution.

Identify SQL injection vulnerabilities on a shopping site by testing parameters such as product id and category. Use url encoding and Burp Suite to validate inputs and test login scenarios.

Explore sql injection vulnerabilities with barb tools, intercept and repeat requests, perform union-based injections to enumerate columns, extract usernames and passwords, and simulate admin login.

Practice manual sql injection testing to identify vulnerable columns, reflect data with union select, enumerate usernames and passwords from users, and log in as administrator using a brute-force workflow.

Identify SQL injection vulnerabilities with testing tools to determine the database type, including Oracle. Enumerate information schema tables and columns to extract users and passwords for admin login.

Explore SQL injection vulnerabilities on a target site using Burp Suite to enumerate Oracle databases, tables, and columns, extract usernames and passwords, and log in as administrator.

learn to detect and exploit sql injection vulnerabilities with burpsuite, performing blind sql injection to uncover admin credentials and user passwords through crafted payloads.

This lab demonstrates identifying and exploiting sql injection vulnerabilities in an oracle backend using barb tools, enumerating databases, users, and passwords through conditional queries and intruder payloads.

Test sql injection vulnerabilities with burpsuite, intercepting requests, using repeater, and validating parameters. Identify database types (postgresql, mysql), exploit time delays with sleep, and enumerate users via intruder.