SEC642: Advanced Web App Penetration Testing, Ethical Hacking, and Exploitation Techniques
Provided by SANS
About the course
SEC642 will teach you the advanced skills and techniques required to test modern web applications and next-generation technologies. In this course, you will learn through a combination of lectures, real-world experiences, and hands-on exercises that will teach you the techniques to test the security of tried-and-true internal enterprise web technologies, as well as cutting-edge Internet-facing applications. On the final day of the course, you will apply the knowledge you have acquired in a Capture-the-Flag competition, a fun environment based on real-world technologies.
What You Will Learn
Can Your Web Applications Withstand the Onslaught of Modern Advanced Attack Techniques?
Modern web applications are growing more sophisticated and complex as they use exciting new technologies and support ever-more critical operations. Long gone are the days of basic HTML requests and responses. The complexity of HTTP and modern web applications is progressing at breathtaking speed. With the demands of highly available web clusters and cloud deployments, web applications are looking to deliver more functionality in smaller packets at a decreased strain on backend infrastructure. Welcome to an era that includes tricked-out cryptography, WebSockets, HTTP/2, and a whole lot more. Are your web application assessment and penetration testing skills ready to evaluate these impressive new technologies and make them more secure?
Are You Ready to Put Your Web Applications to the Test with Cutting-Edge Skills?
This pen testing course is designed to teach you the advanced skills and techniques required to test modern web applications and next-generation technologies. The course uses a combination of lectures, real-world experiences, and hands-on exercises to teach you the techniques to test the security of tried-and-true internal enterprise web technologies, as well as cutting-edge Internet-facing applications. The final course day culminates in a Capture-the-Flag competition where you will apply the knowledge you acquired during the previous five course sections in a fun environment based on real-world technologies.
Hands-on Learning of Advanced Web Application Exploitation Skills
We begin by exploring advanced techniques and attacks to which all modern-day complex applications may be vulnerable. We'll learn about new web frameworks and web backends, then explore encryption as it relates to web applications, digging deep into practical cryptography used by the web, including techniques to identify the type of encryption in use within the application and methods for exploiting or abusing it. We'll then look at alternative front ends to web applications and web services such as mobile applications, and examine new protocols such as HTTP/2 and WebSockets. The last section of the course, before the Capture-the-Flag competition, will focus on how to identify and bypass web application firewalls, filtering, and other protection techniques.
You Will Learn
- How to discover and exploit vulnerabilities in modern web frameworks, technologies, and backends
- Skills to test and exploit specific technologies such as HTTP/2, Web Sockets, and Node.js
- How to evaluate and find vulnerabilities in the many uses of encryption within modern web applications
- Skills to test and evaluate mobile backends and web services used in an enterprise
- Methods to recognize and bypass custom developer, web framework, and Web Application Firewall defenses
You Will Be Able To
- Perform advanced Local File Include (LFI)/Remote File Include (RFI), Blind SQL injection (SQLi), and Cross-Site Scripting (XSS) combined with Cross-Site Request Forger (XSRF) discovery and exploitation
- Exploit advanced vulnerabilities common to most backend language like Mass Assignments, Type Juggling, and Object Serialization
- Understand the special testing methods for content management systems such as SharePoint and WordPress
- Identify and exploit encryption implementations within web applications and frameworks
- Discover XML Entity and XPath vulnerabilities in SOAP or REST web services and other datastores
- Use tools and techniques to work with and exploit HTTP/2 and Web Sockets
- Identify and bypass Web Application Firewalls and application filtering techniques to exploit the system
What You Will Receive
- A copy of the SEC642 Slingshot VM, which includes some of the latest and greatest open-source penetration testing tools for web application testing and Burp Suite Pro
- A six-course session booklet that includes course slides, student notes, and multiple hands-on exercises for each day
Syllabus (36 CPEs)
SEC642.1: Advanced Attacks
SEC642.2: Web Cryptography
SEC642.3: Alternative Interfaces and XML
SEC642.4: Modern Web Application Attacks Part 1
SEC642.5: Modern Web Application Attacks Part 2
SEC642.6: Capture-the-Flag Challenge
This course assumes that you have a solid understanding of web penetration techniques and methodologies. You should be familiar with the HTTP protocol, HTML, and web applications. A minimum or one to two years of web penetration testing experience, successful completion of the GWAPT certification, or having attended the SEC542 course would fulfill these prerequisites.
Important! Bring your own system configured according to these instructions!
A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.
x64-compatible 2.0 GHz CPU minimum or higher
At least 20 GB of hard drive space
At least 4 GB of RAM, preferably 8 GB of RAM
Host Operating System: Latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below. It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices. Those who use a Linux host must also be able to access exFAT partitions using the appropriate kernel or FUSE modules. Note: Apple systems using the M1 processor cannot perform the necessary virtualization at this time and cannot be used for this course.
VMware: Download and install either VMware Workstation Pro 15.5.x, VMware Player 15.5.x or Fusion 11.5.x or higher versions before class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial on their website.
Other virtualization software, such as VirtualBox and Hyper-V, are not appropriate because of compatibility and troubleshooting problems you might encounter during class.
VMware Workstation Pro and VMware Player on Windows 10 are not compatible with Windows 10 Credential Guard and Device Guard technologies. Please disable these capabilities for the duration of the class if they are enabled on your system by following instructions in this document.
IMPORTANT NOTE: While not usually necessary for this class, you may be required to disable your anti-virus tools temporarily for some exercises, so make sure you have the anti-virus administrator permissions to do so. DO NOT plan on just killing your anti-virus service or processes, because most anti-virus tools still function even when their associated services and processes have been terminated. For many enterprise-managed clients, disabling your anti-virus tool may require a different password than the Administrator account password. Please bring that administrator password for your anti-virus tool.
During the hands-on exercises, you will be connecting to the classroom network. While perpetration of any attack is contrary to exercise rules and SANS ethics policy, your laptop might nevertheless be attacked. Do not have any sensitive data stored on the system. SANS is not responsible for your system if someone in the class attacks it in the workshop.
By bringing the right equipment and preparing in advance, you can maximize what you will see and learn, as well as have a lot of fun.
Your course media will now be delivered via download. The media files for class can be large, some in the 40 to 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take for you to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.
SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.
"SANS SEC642: Advanced Web Application Penetration Testing, Ethical Hacking, and Exploitation Techniques picks up where other courses end. We explore modern applications, modern protocols, and modern attacks. We examine in detail the tools and techniques used to identify and exploit vulnerabilities in new ways. We truly take penetration testing of web applications to a whole new and more advanced level in this class. I have always found that giving back to the information security community has benefited my career more than anything else has. This is how we pay it forward. We hope that you enjoy this course as much as we did writing it!" - Adrien de Beaupre
"SEC642 is a fantastic course that teaches advanced techniques. Adrien de Beaupre is one of the best instructors I've had, and I will certainly take more courses he teaches in the future." - Walt Carruth, Real Page
Who Should Attend SEC642?
- Web penetration testers
- Red team members
- Vulnerability assessment personnel
- Network penetration testers
- Security consultants
- QA testers
- System administrators
- IT managers
- System architects
"SEC642 is a great follow-up to SANS SEC542. From day one, the content is applicable to real-world penetration testing." - Mike Saunders, Cargill