Masterclass: Pentesting and Securing Mobile and Web Applications

Course Overview

The course teaches mobile and web application security concepts, including the techniques on how to attack and how to respond with an appropriate countermeasure implementation. Our course has been developed around professional penetration testing and security awareness in the business and IT fields. To make sure that all participants gain the necessary security knowledge, our classes have an intensive hands-on format. Every topic is supported with virtual labs instructions and code examples. Knowledge and concepts of penetration testing are universal in all programing languages nevertheless exercises and code examples require Microsoft .Net programing skills and android development basics.

Target Audience

Developers, web developers, mobile solution developers, solution architects, security professionals with strong programing skills and other people responsible for implementing security of development process or application security.

Course Objectives

• Recognise the security risks that can be found in modern applications
• Perform pen tests on web application and web API’s
• Understand Security concepts in relation to Mobile Android Applications
• Test the end to end mobile and web application solution
  

Course Content

Module 1: OWASP Top 10 Application Security Risks

• Injection
• Broken Authentication
• Sensitive Data Exposure
• XXE
• Broken Access Control
• Security Misconfiguration
• Cross-Site Scripting
• Insecure Deserialization
• Components with Known Vulnerabilities
• Insufficient Logging & Monitoring

Module 2: Analysis of Web Application Security

In this module, you will learn how to perform series of web applications and web API penetration tests. Additionally, you will learn the most effective ways of securing them.

• Methodologies of Web Application testing
• Black Box Analysis
• White Box Analysis
• Automating penetration tests with OWASP ZAP
• Web Application Firewall: Traditional vs Anomaly detection modes

Module 3: Analysis of Android Application Security

This module focuses on mobile Android applications, its general design, security concepts and different approaches to penetration tests and security, especially independent from OS version.

• System architecture
• Android OS security features
• Black and White box tests for mobile
• Android storage solutions
• Encryption in App and OS

Module 4: End to End solution testing

This module covers different methods of penetration testing of whole solutions regardless of technology used as development platform.

• Methodologies, solutions and tools
• Fuzzy testing for Mobile applications
• Fuzzy testing for Web API
• Performance testing

Module 5: Use cases and discussion

This module covers discussion about security solutions specific in different technologies. It also demonstrates practical and complete use case of penetration testing and solution in 'hands-on labs' environment.

Course Prerequisites

• Microsoft .Net programing skills and android development basics

Test Certification

Recommended as preparation for the following exams:

• There is no specific exam aligned to this course, however all attendees will receive an online Certificate of Attendance