Certified Secure Web Application Engineer

BENEFITS OF CSWAE COURSE

Course Name: Certified Secure Graduates of the mile2 Certified Secure
Web Application Engineer Web Application Engineer training obtain Also available as:
Duration: 4 days real world security knowledge that enables
them to recognize vulnerabilities, exploit LIVE VIRTUAL TRAINING
Language: English
system weaknesses and help safeguard Attend live class from
Format: against threats. anywhere in the world!
Instructor-led COURSE OVERVIEW
Live Virtual Training  Live Presentations with Powerful
functionality that delivers easy
Prerequisites: Web applications are increasingly more viewing of slides and other
 A minimum of 12 months sophisticated and as such, they are documents, shared Internet
experience in networking critical to almost all major online access, virtual whiteboard, and
technologies businesses. As more applications are a media center all through an
easy-to-use toolbar.
 Sound knowledge of web enabled, the number of web  Application, file, and desktop
TCP/IP application security issues will increase, sharing enable you to view live
 Knowledge of Microsoft traditional local system vulnerabilities, demonstrations.
packages such as directory traversals, overflows  Dedicated high spec remote PC
 Network+, Microsoft, and race conditions, are opened up to per student with full access as if
Security+ you are sitting in-front of the PC
new vectors of attack.
 Basic Knowledge of Linux in the classroom.
is essential  Instructor views each students
The responsibility for the security of session when you perform your
Student Materials: hands on labs, the instructor can
sensitive systems will rest increasingly
access your remote system to
 Student Workbook with the web developer, rather than the
demonstrate and assist while
 Student Reference vendor or system administrator. As with you sit back to absorb the
Manual most security issues involving classroom style mentoring you
Certification Exam: client/server communications, Web expect.
application vulnerabilities generally  Public and private text chat
CSWAE- Certified Secure Web allows for increased interactivity
Application Engineer stem from improper handling of client between students and instructor
requests and/or a lack of input
Certification Track: validation checking on the part of the
CSWAE- Certified Secure Web App developer.
Engineer
CPTE - Certified Pen Testing
Engineer™
The mile2 Certified Secure Web
CPTC - Certified Pen Testing Application Engineer training teaches
Consultant™ students to detect various security
CDFE - Certified Digital Forensics issues with web applications and
Examiner™
identify vulnerabilities and risks.
 2

UPON COMPLETION
Upon completion of the CSWAE students will be able to confidently undertake the CSWAE certification
examination (recommended). Students will enjoy an in-depth course that is continuously updated to
maintain and incorporate the ever changing web application and secure code technologies. This course
offers up-to-date proprietary laboratories that have been researched and developed by leading security
professionals from around the world.
COURSE DETAILS

Module 0: Web Application Intro Module 11: Web Application Penetration Testing
Module 1: Software Security Explained
Module 12: Web 2.0
Module 2: Software Security Vulnerabilities
Module 13: Other Key Items
Module 3: Setting the Stage (The Attack)
Module 4: OWASP Top 10 Module 14: PCI Compliance
Module 5: Threat Modeling Module 15: Secure Code – Attacks
Module 6: IBM Appscan
Module 16: Securing Applications
Module 7: Vulnerabilities that Appscan Finds
Module 8: Burp Suite Module 17: Risk Management
Module 9: Secure Software Development Life Module 18: Security Architecture Design
Cycle
Module 10: Writing Secure Code Module 19: Mobile Application Security

OBJECTIVE OF LABORATORY SCENARIOS

This is an intensive hands-on class; you will spend 60% of student class time performing labs focusing on
both the OWASP model as well as the technicalities that detail PCI compliance in respects to secure
coding.
.
 3

DETAILED MODULE DESCRIPTION

Module 0 – Web App Class Intro

Introduction Learning Aids
Course Overview Labs
Course Objectives Class Prerequisites
How will we achieve it:

Module 1 – Software Security Explained

Overview SQL Injection and Injection Flaws
Why Care About Security? Bobby Tables
Threats SQL Injection Example in .NET
Definition of Software Security E-Commerce Web Site
Understanding Software Security E-Commerce Login
Software Development Life Cycle Demonstration
Testing SQL Injection
Risk Assessments SQL Injection Buggy Code
Secure Coding Fundamentals SQL Injection Countermeasures
Software Security Command Injection
What is software security? Information Integrity
Why is software security so tough? Insufficient Anti-Automation
So what is the problem? XML Poisoning
What can we do about it? Malicious Code Execution
Foundation of Security Malicious Code Execution Example
Challenges With Security RSS Atom Injection
The Rise of Insecure Software WSDL Scanning and Enumeration
Connectivity Client side validation in AJAX routines
Extensibility Web Service Routing Issues
Complexity Parameter Manipulation With SOAP
Software Security Methodology XPATH Injection SOAP message
Process Overview RIA Client Binary Manipulation
What we can do about it? Web 2.0 Information Leakage
Roles and Responsibilities Application Denial of Service
Developer’s Role Application Denial of Service Remediation
Common Vulnerabilities Application-Layer DoS
Buffer Overflow Real-World Test
Common Vulnerabilities Hacktics Results
Session Hijacking Improper Error Handling
Broken Access Control Session Management
Broken Account and Session Management Directory Traversal
Common Vulnerabilities Insecure Software is Everywhere
Cross Site Scripting OWASP
XSS Example Security Focus
Cross Site Scripting Attacks SecurityFocus (Demo)
XSS Example ISS (Demo)
Cross Site Request Forgery Review
Information Leakage
Injection Flaws
 4

Module 2 – Software Security Vulnerabilities

Introduction Phishing Web 2.0 Example
Application Test Script Detected Injection Flaws
Blind SQL injection Cross Site Scripting
Cacheable SSL page Cross Site Scripting Attacks
Cacheable SSL Page Remediation XSS Example
Cross Site Request Forgery SQL Injection and Injection Flaws
Cross Site Request Forgery Attacks Bobby Tables
Database Error Pattern Found SQL Injection Example in .NET
Database Error Message Found E-Commerce Web Site
Direct Access to Administrative Pages E-Commerce Login
E-mail Address Pattern Found SQL Injection
HTML Comments Contain Sensitive SQL Demonstration
Information SQL Injection Buggy Code
Internal IP Address Disclosure SQL Injection Countermeasures
Link Injection to Facilitate Cross Site Web-Based Email
Request Forgery Directory Traversal
Missing Secure Attribute in Encrypted The Principles of Secure Development
Sessions Principle #1 – Input Validation
Possible Server Path Disclosure Possible Places to do Validation
Query Parameter found in SSL Request Principle #3 - Improper Error Handling
Unencrypted Login Request Principle #4 – Authentication and
Cross Site Scripting Authorization
XSS Example Principle #5 – Session Hijacking
Phishing Principle #6 – Secure Communications

Module 3 – Setting the Stage (The Attack)

Learning Attack Methods People Search Engines
Developer’s Point of View Client Email Reputation
Progression of The Professional Hacker Web Server Info Tool: Netcraft
Methods of Obtaining Information Countermeasure: Domainsbyproxy.com
Physical Access Footprinting Countermeasures
Social Access Introduction to Port Scanning
Social Engineering Techniques Popular Port Scanning Tools
Digital Access Port Scan Tips
Passive vs. Active Reconnaissance Most Popular: BackTrack
Footprinting Defined Expected Results
Footprinting Tool: KartOO Website Method: Ping
Footprinting tools Stealth Online Ping
Google and Query Operators NMAP: Preferred Scanning Tool
SPUD: Google API Utility Tool Which services use which ports?
asOnline Social Websites OS Fingerprinting
Identity Theft and MySpace Countermeasures: Scanning
Instant Messengers and Chats Enumeration Overview
Blogs, Forums & Newsgroups Web Server Banners
Internet Archive: The WayBack Machine Practice: Banner Grabbing with Telnet
Domain Name Registration SuperScan 4 Tool: Banner Grabbing
WHOIS SMTP Server Banner
WHOIS Output DNS Enumeration
DNS Databases Web Application Penetration Methodologies
Using Nslookup HTTrack Tool
Dig for Unix / Linux Instructor Demonstration
 5

The Anatomy of a Web Application Attack Tsgrinder

Web Attack Techniques Brute Force Tools
URL mappings to the web application Precomputation Detail
system Cain and Abel’s Cracking Methods
Cracking Techniques LAB 1 – Getting Set Up
Password Guessing LAB 2 – Information Gathering
LAB 3 – Scanning
LAB 4 – Enumeration

Module 4 – OWASP Top 10

Cross Site Scripting Broken Authentication and Session Mgmt
Injection Flaws Business Impacts of Broken Authentication
SQL Injection Finding and Fixing Broken Authentication
Why SQL “Injection”? Broken Access Control
SQL Connection Properties Where Does Access Control Typically
SQL Injection: Enumeration Occur?
SQL Extended Stored Procedures Business Impacts of Broken Access Control
Shutting Down SQL Server Finding and Fixing Broken Access Control
Business Impacts of SQL Injection Insecure Storage
Finding and Fixing SQL Injection Business Impacts of Insecure Storage
Unvalidated Input Finding and Fixing Insecure Storage
Business Impacts of Unvalidated Input Application Denial of Service
Finding and Fixing Unvalidated Input Business Impacts of Application DOS
Buffer Overflows Finding and Fixing Application DOS
Business Impacts of Buffer Overflows Insecure Configuration Management
Finding and Fixing Buffer Overflows Business Impacts of Insecure Configuration
Improper Error Handling Finding and Fixing Insecure Configuration
Business Impacts of Improper Error Where to Learn More
Handling LAB 5 – Database Hacking
Finding and Fixing Improper Error Handling LAB 6 – Hacking Web Applications

Module 5 – Threat Modeling

Overview Threat Methodologies (STRIDE)
Threat Modeling Overview Spoofing Identity
The Process Tampering With Data
Identify Security Objectives Repudiation
Application Review Information Disclosure
Application Diagram Denial of Service
Application Decomposition Elevation of Privilege
Identify Threats Rank the Threats (DREAD)
Harmonized Threat and Risk Assessment How to Respond to Threats
Methodology Mitigating Threats
Framework for the Harmonized TRA Review
Methodology

Module 6 – IBM AppScan

IBM Appscan Chose Web Application Scan
Tell Appscan what you want to do Type in the Demo Web site URL
Let’s Start a New Scan Type in Automatic
 6

Start Full Automatic Scan Let’s Do Some Reconnaissance on the

Let’s Autosave Demo Site
Save assessment What do you notice about the site?
First Appscan Crawls the Application

Module 7 – Vulnerabilities that AppScan Finds

Introduction Microsoft ASP Debugging Enabled
HTTP Response Splitting Sensitive Files Found
Application Input Restrictions Bypass Unencrypted View STATE PARAMETER
Hidden Directory Detected

Module 8 – Burp Suite

What is Burp Suite? Target site map
Burp Suite Tools Target Scope
Burp search Discover Content
Saving and restoring state Message Editor
Restoring state Properties
Remembering settings Extensibility
Lean mode

Module 9 – Secure SDLC

Overview Project Initiation/Concept
Secure Software Development Lifecycle Requirements Gathering
A Secure Process Architecture and Design
Manager’s Point of View Things to Consider
Developer’s Point of View Development
Why Change? Unit Test
Consumer Expectations Implementation and Deployment
Business Responsibility Maintenance
Response? Review
Phases of The Development Lifecycle

Module 10 – Writing Secure Code

Overview Basic and Digest Authentication
Data Validation Form Based Authentication
Defending the Attack Certificate Based Authentication
Error and Exception Handling Strong Authentication
Logging and Auditing Authorization
Authentication Review
Web Authentication Methods
 7

Module 11 – Web Application Penetration Testing

Overview SAINT – Sample Report
Security Code Reviews Hacking Tool: Metasploit
Web Application Penetration testing Direct Attacks Against a Database
Overview Attacking Database Servers
Quick Poll Obtaining Sensitive Information
Benefits of a Penetration Test Hacking Tool: SQL Ping2
Article and Example of WAPT Hacking Tool: osql.exe
Current Problems in WAPT Hacking Tool: Query Analyzers
Changes In Software Development Hacking Tool: SQLExec
Reality check Oracle Security Expert
Changes Required From Security Testers Hardening Databases
Types of Penetration Testing Analyzing Risk
Penetration Testing Methodologies Report Results Matrix
FireFox – The ScriptKiddie’s Dream Findings Matrix
Assessment Tool: Stealth HTTP Scanner Principles
Instructor Demonstration Process
Acunetix Web Scanner Rank the Threats (DREAD)
Wikto Web Assessment Tool DREAD
Instructor Demonstration Risk Assessment
Tool: Paros Proxy Testing Methodologies
Instructor Demonstration Integrating Testing in the Dev Lifecycle
Tool: Burp Proxy Implementing Defense In-depth
Fuzzers On the Horizon
OWASP Top Ten Web Vulnerabilities Website Review
Nessus Review
Nessus Report

Module 12 – Web 2.0

Introduction Cross Site Request Forgery
What is Web 2.0 and who uses it? Cross Site Request Forgery Attacks
Classic Web Vs Ajax Phishing
Synchronous vs. Asynchronous Phishing Web 2.0 Example
WEB 2.0 Target Application Layout Information Leakage
Web 2.0 Security Vulnerabilities Web 2.0 Information Leakage
Web 2.0 Usability Injection Flaws
Web 2.0 and No SSL Information Integrity
Web 2.0 and Remember Me Insufficient Anti-Automation
Web 2.0 and Social XML Poisoning
Overpowered APIs and Duplicated Code Malicious Code Execution
Outsourcing RSS Atom Injection
Web 2.0 and Cutting Edge Technology WSDL Scanning and Enumeration
Web 2.0 and Trust Client side validation in AJAX routines
Web 2.0 Security Vulnerabilities Web Service Routing Issues
Systems Susceptible to Attacks Parameter Manipulation With SOAP
Insufficient Authentication Controls XPATH Injection SOAP message
Cross Site Scripting RIA Client Binary Manipulation
XSS Example LAB 7 – HP Test Fire
 8

Module 13 – Other Key Items

Overview The Software Market
Other items - Integrated Systems The Market is Changing!
Security is Challenging Present and Future
ISO 21827 SSE-CMM Software Security Is A Different World
Leverage industry standards Root Causes of Application Insecurity
The CMMI Approach Targeting the Root Causes
Integrated Systems What to recommend
What is DMZ? Key Enhancements
Classic Security Model Advanced Enhancements
DNS Application Security Capacity Scorecard
Middleware Defined Compliance & Security Integrated
Integrated Systems Fundamental Requirements
Requirements Integration Through Risk Management
International Standards --SSE-CMM Application Security
What to require Security Management & Compliance
How do you select the correct security
product?

Module 14 – PCI Compliance

Overview Requirement 6.3
Payment Card Industry Requirement 6.4
PCI DSS Overview Requirement 6.5
PCI Overview Requirement 6.6
PCI-Requirement 6 Security Audit Procedures
Requirement 6.1 Compensating Controls
Requirement 6.2 Summary

Module 15 – Secure Code Attacks

Attacks on applications 3rd Party Vendors
OWASP What are the risks?
Injection Flaws Risk to the organization
Cross Site Scripting (XSS) Challenges
Broken Authentication and Session Analyzing Vendor Security
Management Managing the Risk
Insecure Direct Object Reference Outsourcing and Off Shoring
Cross Site Request Forgery (CSRF) Challenges
Misconfiguration of Security Ensure Security
Insecure Cryptographic Storage Tools of the Trade
Failure to Restrict URL Access Summary
Insufficient Transport Layer Protection LAB 8 – Doing a Scan on a Web Service
Invalidated Redirects/Forwards

Module 16 – Securing Applications

What is Software Security? Threat Modeling
Security Terms Traceability Matrix
Attack Vectors OWASP Guides
Threats Discussion
S-SDLC Framework LAB 9 – Vulnerability Software Scanning
 9

Module 17 – Risk Management

Overview Identify Risks
Risk Management Risk Analysis
Why ERM Is Important Identify Assets and Value
Integration of Risk Management into the Identify Threats and Risks
SDLC Determine Impacts
Phase: Requirements Impact vs. Cost to Mitigate
Phase: Design Classify Risks
Phase: Implementation Develop Mitigation Plan
Phase: Integrate / Release Implement
Important Terms Validating Fixes
The Importance of Risk Management Reporting Your Findings
NIST KEYS FOR SUCCESS
When Should it Start www.somap.org
Risk Management Process Review
Know The Business

Module 18 - Security Architecture Design

Overview Secure By Design
Secure Architecture Design Design Considerations
Architecture and Design The SD3 Framework
Security Architecture – Multi-layer Understanding the Environment
SAL – focus on Standardization Discuss Technical Issues
Design for Security Security in Layers
Architectural design Attacks
Protection Man-in-the Middle
What to Consider During Design Session Hijacking
Design Guidelines Buy vs. Build
Design It Secure Secure your Data
The Economics of Software Filters
Forces in Software Things to Remember
Design Considerations Review
Secure Product Development Timeline

Module 19 – Mobile Application Security

Two types of Vulnerabilities Logic or Time Bomb [CWE-511]
Activity Monitoring and Data Retrieval Sensitive Data Leakage [CWE-200]
Unauthorized Dialing, SMS, and Payments Unsafe Sensitive Data Storage [CWE-312]
Unauthorized Network Connectivity Unsafe Sensitive Data Transmission [CWE-
UI impersonation 319]
System Modification (rootkit, APN, proxy Hardcoded Password/Keys [CWE-798]
config)

Additional Lab Exercises-

Linux Fundamentals
Report Writing