Web application Penetration testing & Security

Explore how the same origin policy restricts JavaScript access across origins, requiring matching protocol, hostname, and port to block cross-domain reads and defend web applications.

Configure a local web application proxy, intercept and modify browser requests, crawl sites with spider, analyze requests and responses, and extend Burp Suite with tools like intruder for testing.

Shodan is a search engine for hackers that catalogs internet-connected devices, revealing IP addresses and locations of web servers and other internet of things, and highlighting vulnerabilities.

Explore cross-site scripting basics, showing how unsanitized input reflected in web pages enables JavaScript injections that steal cookies and compromise sites. Identify the three XSS types.

Demonstrate advanced cross-site scripting with BeEF to hook victims' browsers, perform browser-based exploits, and illustrate phishing and credential harvesting on Facebook, Google, and YouTube.

Learn how in-band sql injection attacks, including error-based and union-based techniques, expose database tables, columns, user data, and passwords, enabling attacker access and server takeover.

Explore blind sql injection attack techniques, including boolean-based and time-based methods, to infer database usernames and table names without direct data transfer.

Explore fuzzing techniques to uncover SQL injection vulnerabilities using Burp Intruder, configuring Burp Suite proxy, intercepting requests, and injecting payloads into target input parameters.

Explore CSRF and XSRF attack methods and how attackers exploit authenticated sessions using forged requests and tokens to perform actions like password changes.

Discover how client-side security controls can be bypassed by manipulating input fields, disabled attributes, and JavaScript checks. Learn to inspect elements and understand the limitations of client-side access controls.

Explore local and remote file inclusion attacks, how unsanitized inputs trigger system-level commands, and practical testing to identify misconfigurations and read sensitive files.

Explore xxe attacks in action, revealing how external entity injections exploit xml parsers to access server data via external and internal dtds. Learn practical demonstrations and testing with intercepting proxies.