Practical Web Application Penetration Testing [9/2025, ENG] torrent

Обучающие видео » Компьютерные видеоуроки и обучающие интерактивные DVD » Компьютерные сети и безопасность

Practical Web Application Penetration Testing (WAPT)

Год выпуска: 9/2025
Производитель: Udemy
Сайт производителя: https://www.udemy.com/course/practical-wapt/
Автор: Leonardo Tamiano
Продолжительность: 19h 20m
Тип раздаваемого материала: Видеоурок
Язык: Английский
Описание: This course was developed with the clear objective of showing in practice what it means to perform a Web Application Penetration Test exactly as it would happen with a real client in a typical week of work, an approach that lets learners quickly reach the experience level of a junior penetration tester. It is aimed at those interested in working in the security industry, wanting to learn how to test the security of a web application, or who like hands-on, practice-based learning.

The course shows how to test the security of Secure Bank, a home banking application designed as a training ground for penetration testers and web developers, and during the test learners find 40+ security issues across categories including information disclosure, injection vulnerabilities, authentication, authorization, session management, business logic vulnerabilities, data validation vulnerabilities, cryptography and insecure configuration. For each security issue, the course shows how to find the vulnerable behavior, how to exploit it and finally how to explain it to the final client using written Proof of Concepts (PoCs), ending with 40 different PoCs for 40 different vulnerabilities — giving a very good intuition on WAPT testing that will help learners get started in the industry or simply refine their skills if needed.
[spoiler="Содержание"]
1 - Introduction To The Course
1 - Whoami (04:14)
2 - Learning Objectives (07:01)
3 - Required Knowledge (02:26)
4 - Course Contents (02:45)

2 - Software Security
5 - Section Overview (04:51)
6 - Security Properties Cia (17:08)
7 - Software Vulnerabilities (11:27)
8 - Example Sql Injection (16:42)
9 - Example Idor (10:14)
10 - Example Stored Xss (12:25)
11 - Example Cmd Injection (09:42)
12 - Software Risks (10:48)
13 - Software Vulnerabilities Vs Software Risks (05:36)
14 - Example User Enumeration (07:48)
15 - How To Measure Security (06:35)
16 - Vulnerability Assessment Va (07:47)
17 - Network Penetration Test Npt (06:48)
18 - Web Application Penetration Test Wapt (16:24)
19 - Secure Code Review Scr (06:48)
20 - Other Testing Activities (06:26)
21 - The Cve System (10:48)
22 - Common Weakness Enumeration Cwe (07:06)
23 - The Cvss System (14:00)
24 - Cve202222965 (22:21)
25 - Owasp (15:47)
26 - Phrack (05:35)
27 - On Capture The Flags Ctfs (11:43)
28 - Security In The Sdlc (13:44)

3 - Starting The Wapt Activity
29 - Introducing Secure Bank (11:07)
30 - Deploying Secure Bank (10:25)
31 - Secure Bank Troubleshooting (00:41)
32 - Start Of The Wapt Activity (07:30)
33 - Http Testing Setup (04:20)
34 - On The Http Protocol (11:24)
35 - Service Scan With Nmap (07:45)
36 - Burp Suite Installation (06:42)
37 - Burp Suite Usage (28:20)
38 - Burp Suite Extensions (02:47)
39 - Extra Mitmproxy (05:32)
40 - Extra Connect Browser To Proxy (07:58)
41 - Testing Coverage (10:25)
42 - Categories Of Vulnerabilities (11:35)

4 - Information Disclosure
43 - Introduction To Information Disclosure (06:30)
44 - Files And Directories Enumeration (10:51)
45 - Issue 1 Swagger Api Exposed (12:16)
46 - Issue 2 Directory Listing (07:45)
47 - Issue 3 Exposed Stack Trace (15:01)
48 - Issue 4 Unmanaged Errors (20:21)
49 - Issue 5 Exposure Of Sensitive Functionality (15:56)
50 - Issue 6 Pdf Metadata Disclosure (08:18)
51 - Issue 7 Server Banners (05:47)

5 - Injection Vulnerabilities
52 - Introduction To Injection Vulnerabilities (05:40)
53 - Issue 1 Sql Injection (33:27)
54 - Sql Injection Exploitation With Sqlmap (06:26)
55 - Extra Sql Injection Code Review (11:26)
56 - Issue 2 Stored Xss (18:35)
57 - Issue 3 Reflected Xss (13:11)
58 - Issue 4 Path Traversal (17:40)
59 - Extra Path Traversal The Proc Filesystem (07:13)
60 - Issue 5 Xml External Entity Xxe (12:09)
61 - Issue 6 Serverside Request Forgery Ssrf (17:40)
62 - Extra Ssrf Arbitrary File Write To Stored Xss (06:29)
63 - Issue 7 Command Injection (15:02)
64 - Conclusion (02:01)

6 - Authentication
65 - Introduction To Authentication (04:59)
66 - Issue 1 Authentication Bypass (12:40)
67 - Issue 2 User Enumeration (11:56)
68 - Issue 3 Insecure Password Update (11:54)
69 - Issue 4 Weak Password Policy (09:21)
70 - Issue 5 Lack Of Mfa (06:34)
71 - Conclusion (02:58)

7 - Authorization
72 - Introduction To Authorization (07:56)
73 - Issue 1 Idor Part 1 (11:58)
74 - Issue 1 Idor Part 2 (14:32)
75 - Issue 2 Horizontal Privilege Escalation (14:48)
76 - Issue 3 Vertical Privilege Escalation Part 1 (14:54)
77 - Issue 3 Vertical Privilege Escalation Part 2 (11:22)
78 - Conclusion (01:21)

8 - Session Management
79 - Introduction To Session Management (04:49)
80 - Issue 1 Insecure Session Cookie (07:32)
81 - Issue 2 Lack Of Security Attributes In Session Cookie (12:01)
82 - Issue 3 Improper Logout (04:58)
83 - Issue 4 Csrf In Password Update (35:15)
84 - Testing For Session Fixation (04:04)
85 - Issue 5 Missing Antiautomation Controls (16:52)
86 - Issue 6 Concurrent Sessions Allowed (06:44)
87 - Introduction To Json Web Tokens Jwts (13:21)
88 - Jwt Attack 1 Unverified Signature (05:28)
89 - Jwt Attack 2 None Algorithm (06:47)
90 - Jwt Attack 3 Weak Signing Key (11:36)
91 - Jwt Attack 4 Algorithm Confusion (21:05)
92 - Conclusion (01:47)

9 - Business Logic Vulnerabilities
93 - Introduction To Business Logic (04:00)
94 - Issue 1 Infinite Money (08:52)
95 - Issue 2 Race Condition In Store (14:28)

10 - Validation Vulnerabilities
96 - Introduction To Validation (06:25)
97 - Issue 1 Malicious File Upload (14:15)
98 - Issue 2 Arbitrary File Upload (08:55)
99 - Issue 3 Arbitrary File Write Location (15:44)
100 - Issue 4 Open Redirect (07:43)
101 - Issue 5 Redos (16:18)
102 - Issue 6 Insecure Deserialization (30:06)

11 - Cryptography
103 - Introduction To Cryptography (03:44)
104 - Issue 1 Insecure Communication Channel (17:03)
105 - Issue 2 Insecure Password Storage (14:05)
106 - Issue 3 Hardcoded Credentials (09:13)
107 - Issue 4 Insecure Randomness (09:10)

12 - Insecure Configuration
108 - Introduction To Insecure Configuration (01:24)
109 - Issue 1 Source Code In Docker Container (08:25)
110 - Issue 2 Lack Of Contentsecurity Policy Csp (09:20)
[/spoiler]
Файлы примеров: не предусмотрены
Формат видео: MP4
Видео: AVC, 1920x1080, 16:9, 30fps, 2188kbps
Аудио: AAC, 48.0Hz, 62.7kbps, stereo
[spoiler="Скриншоты"]







[/spoiler]