امیر مجد

• پیشرفته متوسط
• مسیر قرمز
• ۱۴ درس

دربارۀ این دوره

مخاطبان

• متخصصان تست نفوذ
• شکارچیان باگ (Bug Hunters)
• توسعه‌دهندگان وب (Web Developers)
• مدیران سیستم و کارشناسان امنیت شبکه

پیش‌نیازها

• آشنایی کامل با پروتکل HTTP و HTTPS
• آشنایی متوسط با زبان‌های HTML و Javascript
• آشنایی مقدماتی با SQL
• آشنایی کار با ابزار Burp Suite یا ابزارهای مشابه مانند OWASP ZAP
• آشنایی کامل با Linux Essentials

• Introduction and Objectives
• Information Gathering
  • Conduct Search Engine Discovery Reconnaissance (Google Dorking)
  • Fingerprint Web Server
  • Review Webserver Metafiles
  • Enumerate Applications on Webserver
  • Review Web Page Content for Information Leakage
  • Identify Application Entry Points
  • Map Execution Paths Through Application
  • Fingerprint Web Application Framework
  • Fingerprint Web Application
  • Map Application Architecture
• Configuration and Deployment Management Testing
  • Test Network Infrastructure Configuration
  • Test Application Platform Configuration
  • Test File Extensions Handling for Sensitive Information
  • Review Old Backup and Unreferenced Files
  • Enumerate Infrastructure and Admin Interfaces
  • Test HTTP Methods
  • Test HTTP Strict Transport Security (HSTS)
  • Test RIA Cross Domain Policy
  • Test File Permission
  • Test for Subdomain Takeover
  • Test Cloud Storage
  • Test for Content Security Policy (CSP)
  • Test for Path Confusion
• Identity Management Testing
  • Test Role Definitions
  • Test User Registration Process
  • Test Account Provisioning Process
  • Testing for Account Enumeration
  • Testing for Weak Username Policy
• Authentication Testing
  • Testing for Credentials Transported over Encrypted Channel
  • Testing for Default Credentials
  • Testing for Weak Lock Out Mechanism
  • Testing for Bypassing Authentication Schema
  • Testing for Vulnerable Remember Password
  • Testing for Browser Cache Weaknesses
  • Testing for Weak Authentication Methods
  • Testing for Weak Security Question Answer
  • Testing for Weak Password Change or Reset
  • Testing for Weaker Authentication in Alternative Channel
  • Testing Multi-Factor Authentication
• Authorization Testing
  • Testing Directory Traversal File Include
  • Testing for Bypassing Authorization Schema
  • Testing for Privilege Escalation
  • Testing for Insecure Direct Object References (IDOR)
  • Testing for OAuth Weaknesses
• Session Management Testing
  • Testing for Session Management Schema
  • Testing for Cookies Attributes
  • Testing for Session Fixation
  • Testing for Exposed Session Variables
  • Testing for Cross Site Request Forgery (CSRF)
  • Testing for Logout Functionality
  • Testing Session Timeout
  • Testing for Session Puzzling
  • Testing for Session Hijacking
  • Testing JSON Web Tokens (JWT)
  • Testing for Concurrent Sessions
• Input Validation Testing
  • Testing for Reflected Cross Site Scripting (XSS)
  • Testing for Stored Cross Site Scripting (XSS)
  • Testing for HTTP Verb Tampering
  • Testing for HTTP Parameter Pollution
  • Testing for SQL Injection
    • Oracle, MySQL, SQL Server, PostgreSQL, MS Access, NoSQL, ORM, Client-side
  • Testing for LDAP Injection
  • Testing for XML Injection (XXE)
  • Testing for SSI Injection
  • Testing for XPath Injection
  • Testing for IMAP SMTP Injection
  • Testing for Code Injection (LFI / RFI)
  • Testing for Command Injection
  • Testing for Format String Injection
  • Testing for Incubated Vulnerability
  • Testing for HTTP Splitting Smuggling
  • Testing for Host Header Injection
  • Testing for Server-side Template Injection (SSTI)
  • Testing for Server-Side Request Forgery (SSRF)
  • Testing for Mass Assignment 
• Testing for Error Handling
  • Testing for Improper Error Handling
  • Testing for Stack Traces
• Testing for Weak Cryptography
  • Testing for Weak Transport Layer Security (TLS/SSL)
  • Testing for Padding Oracle
  • Testing for Sensitive Information Sent via Unencrypted Channels
  • Testing for Weak Encryption
• Business Logic Testing
  • Test Business Logic Data Validation
  • Test Ability to Forge Requests
  • Test Integrity Checks
  • Test for Process Timing
  • Test Function Limits
  • Testing for the Circumvention of Work Flows
  • Test Defenses Against Application Misuse
  • Test Upload of Unexpected File Types
  • Test Upload of Malicious Files
  • Test Payment Functionality
• Client-side Testing
  • Testing for DOM-Based XSS
  • Testing for JavaScript Execution
  • Testing for HTML Injection
  • Testing for Client-side URL Redirect
  • Testing for CSS Injection
  • Testing for Client-side Resource Manipulation
  • Testing Cross Origin Resource Sharing (CORS)
  • Testing for Cross Site Flashing
  • Testing for Clickjacking
  • Testing WebSockets
  • Testing Web Messaging
  • Testing Browser Storage
  • Testing for Cross Site Script Inclusion
  • Testing for Reverse Tabnabbing
• API Testing
  • API Testing Overview
  • API Reconnaissance
  • API Broken Object Level Authorization (BOLA)
  • Testing GraphQL
• Reporting
  • Reporting Structure
  • Naming Schemes
  • CVSS Calculation

گواهینامه‌ی دوره