Modern WebApp Pentesting w/ BB King | Antisyphon Free Download

Modern WebApp Pentesting w/ BB King | Antisyphon
English | Size: 7.02 GB
Genre: eLearning

Modern Webapp Pentesting is unique in its approach to testing webapps. Too many courses are built around the assumption that a webapp pentester’s skills should grow along a straight line, starting with something like the OWASP Top Ten and culminating in something like Attacking Web Cryptography. Real webapps don’t follow that same path, and neither should real webapp pentesters. Attacking Web Sockets is not more difficult than attacking HTTP traffic, it’s just different. Web APIs are not something you’re qualified to test only after you’ve put your time in on traditional webapps … they’re just different.

This course doesn’t worry about where a student falls on the imaginary scale of beginner to expert but instead focuses on finding and exploiting the kinds of issues found in real webapps today, based on the instructor’s many years of ongoing experience in testing … real webapps today.

Key Takeaways
A reliable methodology for testing today’s webapps
Hands-on experience with the kinds of defects that modern webapps actually have.
Tips and Tricks for effective reporting so the issues you find can be fixed

Who Should Take This Course
Motivated Beginners: the course begins with a dive into the protocols and standards that every webapp relies on. With this often overlooked anchor in the fundamentals, you will more easily see how abusing those things can lead to exploits.

Experienced Testers: With the shared understanding of the fundamental concepts, the middle section of the course moves on to show some of the more common ways that weaknesses appear in real applications. The middle section of the course is a lot of hands-on practice time, with lab options for all skill levels. If you know some exploits, but don’t know deeply how and why they work, this section will make you a more confident and flexible tester.

Everyone: The course wraps up with a deep dive into JSON Web Tokens (JWTs) and an introduction to Web Sockets. After investigating the fundamentals of how those things work, tied neatly to the anchors we started with, you will find a clear and repeatable way to quickly learn about unfamiliar technologies so that you won’t be caught short the next time you see something new for the first time.

If you already test webapps routinely, you may appreciate the focus on the fundamentals, an easy-to-follow testing methodology, and the time spent thinking about how best to report what you find so you’re more likely to drive improvements, earn that bug bounty, or get hired again for a future test.

Audience Skill Level
Motivated Beginners: the course begins with a brief review of protocols and tools so we have a shared mental framework to process the more advanced topics that come later.

Experienced Testers: the majority of the course addresses features and technologies that are not so much “advanced topics” that rely heavily on deep understanding of arcane topics as “newer things that nobody talks about attacking”

If you test webapps exclusively, all day every day, you may still appreciate the time spent on focused practice, methodology, and reporting. Anyone else will also find some new things they can take back to work or bounty-hunting right away.