Training Courses

Course Overview

Organizations and governments fall victim to internet based attacks every day. In many cases, web attacks could be thwarted but hackers, organized criminal gangs, and foreign agents are able to exploit weaknesses in web applications. The Secure Web programmer knows how to identify, mitigate and defend against all attacks through designing and building systems that are resistant to failure. The secure web application developer knows how to develop web applications that aren’t subject to common vulnerabilities, and how to test and validate that their applications are secure, reliable and resistant to attack. The vendor neutral Certified Secure Web Application Engineer certification provides the developer with a thorough and broad understanding of secure application concepts, principles and standards. The student will be able to design, develop and test web applications that will provide reliable web services that meet functional business requirements and satisfy compliance and assurance needs.

The Certified Secure Web Application Engineer course is delivered by high level OWASP experts and students can expect to obtain real world security knowledge that enables them to recognize vulnerabilities, exploit system weaknesses and help safeguard against application threats.

Key Data

Course Name: Certified Secure Web Application Engineer

Duration: 5 days

Format:

Instructor-led

Live Virtual Training

Prerequisites:

• A minimum of 24 months’ experience in software technologies & security
• Sound knowledge of networking
• At least one coding Language
• Linux understanding
• Open shell

Student Materials:

• Student Workbook
• Student Lab Guide
• Exam prep guide

Certification Exam:

Mile2’s CSWAE- Certified Secure Web Application Engineer

CPEs: 32 Hours

Who Should Attend?

• Coders
• Web Application Engineers
• IS Managers
• Application Engineers
• Developers
• Programmers

Upon Completion

Upon completion, Certified Secure Web Application Engineer students will be able to establish industry acceptable auditing standards with current best practices and policies. Students will also be prepared to competently take the C)SWAE exam

Exam Information

The Certified Secure Web Application Engineer exam is taken online through Mile2’s Assessment and Certification System (“MACS”), which is accessible on your mile2.com account. The exam will take 2 hours and consist of 100 multiple choice questions. The cost is $500 USD and must be purchased from Mile2.com.

Course Content

Module 1: Web Application Security

Module 2: OWASP TOP 10

Module 3: Threat Modeling & Risk Management

Module 4: Application Mapping

Module 5: Authentication and Authorisation attacks

Module 6: Session Management attacks

Module 7: Application Logic attacks

Module 8: Data Validation

Module 9: AJAX attacks

Module 10: Code Review and Security Testing

Module 11: Web Application Penetration Testing

Module 12: Secure SDLC

Module 13: Cryptography

Lab Content

Module 1 – Environment Setup and Architecture

Module 2 – OWASP TOP 10 2013

Module 3 – Threat Modeling

Module 04 – Application Mapping & Analysis

Module 5 – Authentication and Authorization attacks

Module 06 – Session Management attacks
Module 9 – AJAX Security

Module 10 – Code Review and Security Testing

Lab 10-1 – Code Review

Lab 10-2 Security Test Scripts

Lab 10-3 Writing Java Secure Code

Annex 11: Alternatives Labs

Lab 11-1: WebGoat & Webscarab

Lab 11-2: WebGoat – Cross Site Request Forgery (CSRF)

Lab 11-3: Missing Function Level Access Control

Lab 11-4: Perform Forced Browsing Attacks

Course Overview

This course is an intense few days covering the keys to hacking with PowerShell. We know that most companies have an Active Directory infrastructure that manages authentication and authorization to most devices and objects within the organization. Many use PowerShell to speed up and simplify management, which only makes sense. Did you know that a large percentage of hacks over the last year included PowerShell based attacks? Well they did, which is why we spend 4 days learning how to hack like the pros using nothing but what is already available to us in Windows or now in open source code on Mac and Linux! The course is based on real world implementations of a windows infrastructure along with real world penetration testing techniques. You will leave with a real strong skill set to help test your windows environment like never before. An attendee will also walk away with a strong skill set on how to help prevent these attacks from happening in the first place!

Here are just a few things you will take away from this course:

• Detailed Lab Manual
• VMs for performing labs on your own
• New ideas on testing your own AD infrastructure
• Attacks you can use immediately
• How to secure against PowerShell attacks

Key Data

Course Title: Certified PowerShell Hacker

Duration: 4 Days

Class Format Options: Prerequisites:

General Understanding of Pen Testing

General Understanding of Active Directory

General Understanding of scripting and programming

Student Materials:CPEs: 32

Who Should Attend?

• Penetration Testers
• Microsoft Administrators
• Security Administrators
• Active Directory Administrators
• Anyone looking to learn more about security

Upon Completion

Upon completion, the Certified PowerShell Hacker candidate will be able to competently take the CPSH exam.

Exam Information

The Certified PowerShell Hacker exam is taken online through Mile2’s Assessment and Certification System (“MACS”), which is accessible on your mile2.com account. The exam will take 2 hours and consists of 100 multiple choice questions. The cost is $500 USD and must be purchased from Mile2.com.

Outline

Module 0 – Course Introduction

Module 1 – Introduction to PowerShell

Module 2 – Introduction to Active Directory and Kerberos

Module 3 – Pen Testing Methodology Revisited

Module 4 – Information Gathering and Enumeration

Module 5 – Privilege Escalation

Module 6 – Lateral Movements and Abusing Trust

Module 7 – Persistence and Bypassing Defenses

Module 8 – Defending Against PowerShell Attacks