COURSE OUTLINE
ETHICAL HACKING
Certified Security Testing
Professional (CSTP)
CORE-LEVEL COURSE
Web application flaws
can leave an organisation
and its customers
vulnerable to attacks.
This web application
ethical hacking course
will give you the knowledge
of, and protection
against, the ‘OWASP Top
Ten Web Application
Security Vulnerabilities’,
an essential component
of modern information
security strategies and
a requirement of the
Payment Card Industry
Data Security Standard
(PCI DSS).
C
U
RI
TY
TESTIN
G
PR
SE
OF
TIFIED
ESSIONAL
CER
•
•
ET
HI G
C AL IN
H AC K
Cost: £1,797.00 + VAT Duration: 3 days
COURSE OVERVIEW WHO SHOULD ATTEND
This three-day course is designed to Anyone with responsibility for, or
give you the skills you need to undertake an interest in, the security of web
an application penetration test in order applications, including:
to ensure valuable data and assets zzSystem administrators
are effectively protected. You will zzSoftware developers
have access to a functional ASP.NET zzBudding penetration testers
and PHP application through which zzAnyone subject to the requirements
theory is reinforced by way of practical of the Payment Card Industry Data
exercises in order to demonstrate Security Standard (PCI DSS)
hacking techniques with defensive
countermeasures always in mind. PREREQUISITES
An understanding of how a web page
THE SKILLS YOU WILL LEARN is requested and delivered:
zzA number of methodologies for zzAre you familiar with the high-level
undertaking a web application components involved, e.g. browsers,
penetration test web servers, web applications and
zzHow to exploit vulnerabilities to access databases?
data and functionality zzWhat are HTTP and HTML?
zzA range of defensive countermeasures
as well as sufficient knowledge as to An understanding of databases and
how to counter these attacks SQL would also be an advantage:
zzDo you understand the concept
KEY BENEFITS of data storage in tables within a
This course will enable you to: relational database?
zzLearn effective techniques to identify zzCan you construct a simple SELECT
exploits and vulnerabilities statement to extract data from a table?
zzImprove your ability to respond
effectively to cyber threats WHAT QUALIFICATION
zzGain valuable preparation for the WILL I RECEIVE?
CREST Registered Penetration Tester Those delegates successfully passing
(CRT) examination and the knowledge the exam at the end of the course will
required to join our CAST course be awarded 7Safe’s Certified Security
(advanced web application security) Testing Professional (CSTP) qualification.
zzAcquire the skills and understanding
to progress to the next stage in your
career as a security professional
To find out if our cyber training is right for you, and to make a booking,
contact our education team on 01763 285 285 or email education@7safe.com
 COURSE OUTLINE

ETHICAL HACKING C
U
RI
TY
TESTIN
G

PR
SE
Certified Security Testing

OF
TIFIED

ESSIONAL
CER
Professional (CSTP)

•
•
ET
HI G
C AL IN
H AC K

CORE-LEVEL COURSE Cost: £1,797.00 + VAT Duration: 3 days

“The course content SYLLABUS

helped to reinforce my 1. Principles 6. Broken Access Control
existing knowledge and a. Web refresher a. Insecure Direct Object Reference
give real world examples b. Proxies b. Direct vs indirect object
and practical exercises c. The OWASP Top Ten references
for the key features of the d. Web application security c. Cross-site Request Forgery
content and syllabus.” auditing (CSRF)
 STP Delegate
C e. Tools and their limitations d. Missing Function Level Access
NewVoiceMedia Ltd f. HTTP request and response Control
modification e. Unvalidated Redirects and
g. Logic flaws Forwards

2. Injection 7. Security Misconfiguration

a. Types
b. Databases overview –
data storage, SQL
c. Exploiting SQL injection –
e.g. data theft, authentication
d. Exploiting Blind SQL injection
e. Exploiting stored procedures
and Bypass
f. Exploiting leaked information
through errors
g. Exploiting Server-Side
Template Injection (SSTI)
h. Exploiting Server-Side
Request Forgery (SSRF)
i. Exploiting Application
Programming Interface (API)
3. Broken Authentication
a. Attacking authentication pages
b. Exploiting predictable requests
7Safe
c. Session management - cookies
Global Innovation
and Technology Centre
Melbourn 4. Sensitive Data Exposure
Herts, SG8 6DP a. Identifying sensitive data
United Kingdom b. Secure storage methods
tel: +44(0) 1763 285 285  and Conclusions
education@7safe.com
5. XML External Entities (XXE)
www.7safe.com
a. Identifying XXE
b. Scenarios
a. Identifying misconfiguration
b. Scenarios
8. Cross-site Scripting (XSS)
a. JavaScript
b. Email spoofing
c. Phishing
d. Reflected and Persistent XSS
e. Cookies, sessions and session
hijacking
9. Insecure Deserialization
a. Identifying insecure object
b. Scenarios
10. Using Components with
Known Vulnerabilities
a. Identifying well know
vulnerabilities with components
b. Scenarios
11. Insufficient Logging & Monitoring
a. Scenarios
12. Additional Web Auditing Tool
a. Scenarios

To find out if our cyber training is right for you, and to make a booking,
contact our education team on 01763 285 285 or email education@7safe.com