Offensive Perspective - OWASP Security for Developers

Explore the overview of web penetration testing, including information gathering, scanning, enumeration, mapping the target surface, and the distinctions among security audit, vulnerability assessment, and penetration testing.

Begin with information gathering, comparing black box, white box, and gray box approaches. Gray box offers the best balance, using passive and active techniques like search engines and subdomains.

Discover how to gather target information using search operators, caches, and nslookup; identify sites on the same IP and uncover leaked credentials on pastebin.

Explore how Shodan, Webalizer, and BuiltWith identify technologies across websites, enabling attackers to target vulnerable servers, scan by host or IP, and exploit weak libraries and plugins.

Perform active information gathering through scanning and enumeration with tools like Nmap and Nikto to identify live hosts, open ports, service versions, OS, and perform banner grabbing.

Map and analyze a web app by spidering traffic with Burp, identifying server technologies, entry points, and error messages to map vulnerabilities to business logic.

Demonstrates a reflected cross-site scripting attack on a vulnerable DVWA web app by exploiting unsanitized get parameters to steal cookies and hijack sessions.

Demonstrate stored cross-site scripting via a vulnerable comment form using beef, and explain fixes through server-side validation and output encoding to prevent attack vectors.

Demonstrates cross-site request forgery and session riding to force password change using forged requests and cookies. Explains clickjacking and open redirects, and how csrf tokens and http headers prevent them.

Examine OS command injection on servers, showing how attackers use shell_exec, ping, and netcat reverse shells; explore path traversal and file inclusion exposing config files and passwords.

Investigate how SMTP injection via contact forms enables attackers to craft multi-recipient emails, bypass CAPTCHA, and spawn spam, then learn input validation and regex checks to prevent it.

Prevent brute force and username enumeration with strong passwords, CAPTCHA, and rate limiting. Protect credentials in transit and at rest with TLS and proper hashing.

Explore SQL injection techniques, including error-based and blind variants, union-based data extraction, and potential read/write or OS command escalation, with OWASP-based prevention guidance.

Learn to use sqlmap to identify and exploit sql injection in a MySQL database, dump user data and hashes, crack passwords, and deploy a PHP backdoor or shell.

Explore the OWASP top ten API vulnerabilities and mitigations, compare traditional and API-based apps, and learn how strong authorization and token controls prevent data leakage.

Explores API top 10 vulnerabilities including broken authentication, excessive data exposure, broken function level authorization, and misconfigurations, with real-world examples and defense like rate limiting and proper access checks.

Learn the OWASP top ten web security risks, their vulnerabilities like injection, cross-site scripting, and cross-site request forgery, with mitigations and how the community updates categories from 2013 to 2021.

Learn how http security headers harden web apps by limiting vulnerabilities through headers like street transport security, content security policy, and CORS, plus XSS protection and cookie flags.

Json web tokens explain the header, payload, and signature; use for authentication and information exchange with rsa or mac signing; avoid none algorithm and insecure storage.

Learn technical measures and practices for developers, including input validation and encoding, bind parameters for database queries, protect data in transit, encrypt data at rest, and hash and salt passwords.

Encrypt data at rest and ensure data integrity with checksums or hmac, or MD5, and implement strict access controls, authentication, authorization, and secure session management with cookies.

Explore cryptography basics, cryptanalysis tools, and attacks, detailing confidentiality, integrity, authentication, and non-repudiation, plus symmetric and asymmetric encryption and the role of PKI and certificate authorities.

Hashing secures data integrity via irreversible digests, though md5 and sha are deprecated due to collisions. A secret-key based code adds authentication, and tls handshakes optimize communication using hybrid encryption.