For More Details
97011 72454
CYBER SECURITY
INTRODUCTION
WHAT IS CYBERSECURITY
IMPORTANCE OF CYBERSECURITY
CIA TRIED:
CONFIDENTIALITY
INTEGRITY
AVAILIBITY
COMMON THREATS IN CYBERSECURITY
WEB APPLICATION ATTACKS
DIRECTORY TRAVERSAL
CROSS-SITE SCRIPTING
SQL INJECTION
PASSWORD CRACKING
BRUTE FORCE ATTACK
DICTIONARY ATTACK
PHISHING ATTACK
MAN-IN-THE-MIDDLE ATTACK
DENIAL OF SERVICE (DOS)
DISTRIBUTED DENIAL OF SERVICE (DDOS)
MALWARE TYPES:
VIRUS
WORMS TROJANS
RANSOMWARE
skilltransform.com 97011 72454
FUNDAMENTALS OF NETWORKING
INTRODUCTION TO NETWORKING
UNDERSTANDING NETWORKS AND NETWORKING
NETWORKING MODELS
OSI REFERENCE MODEL
TCP/IP MODEL
PRINCIPLES OF IP ADDRESSING
UNDERSTANDING IP ADDRESSES
PRIVATE AND PUBLIC
TYPES OF IP ADDRESSING: IPV4 AND IPV6
SUBNETTING TECHNIQUES
TYPES OF NETWORKS:
LAN
MAN
WAN
INTERNET
NETWORK TOPOLOGIES:
BUS
RING
STAR
MESH
ESSENTIAL NETWORK COMPONENTS: NIC CARDS, MAC
ADDRESSES,MEDIA, AND DEVICES (HUBS, SWITCHES, ROUTERS,
FIREWALLS).
skilltransform.com 97011 72454
FUNDAMENTALS OF NETWORKING
COMMONLY USED PROTOCOLS & PORTS ARP PROTOCOL
DHCP PROTOCOL
DNS PROTOCOL
HTTP PROTOCOL
FTP PROTOCOL
SMTP PROTOCOL
SSH PROTOCOL
TELNET PROTOCOL
BASICS OF OPERATING SYSTEMS
INTRODUCTION TO OPERATING SYSTEMS
OPERATING SYSTEM STRUCTURE
KERNEL VS. USER MODE
OVERVIEW OF WINDOWS, LINUX, AND MAC OS
INSTALLATION PROCESSES FOR WINDOWS AND LINUX BASIC OF
FILE SYSTEM AND PERMISSIONS
WINDOWS
LINUX
USER ACCOUNTS AND GROUPS
skilltransform.com 97011 72454
UNDERSTANDING HACKING
WHAT IS CYBERSECURITY
IMPORTANCE OF CYBERSECURITY CIA TRIED:
CONFIDENTIALITY
INTEGRITY
AVAILIBITY
COMMON THREATS IN CYBERSECURITY
TYPES OF HACKING
ETHICAL
UNETHICAL
TYPES OF HACKERS
WHITE HAT
GREY HAT
BLACK HAT
GENERAL HACKING PROCESS
INFORMATION GATHERING
VULNERABILITY ASSESSMENT
EXPLOITATION
POST EXPLOITATION
CLEARING TRACK
PHISHING ATTACK
MAN-IN-THE-MIDDLE ATTACK
DENIAL OF SERVICE (DOS)
DISTRIBUTED DENIAL OF SERVICE (DDOS)
skilltransform.com 97011 72454
WEB APPLICATION PENETRATION TESTING
INFORMATION GATHERING:
MANUALLY EXPLORE THE SITE
SPIDER/CRAWL FOR MISSED OR HIDDEN CONTENT
CHECK FOR FILES THAT EXPOSE CONTENT, SUCH AS
ROBOTS.TXT,SITEMAP.XML,DS_STORE
CHECK THE CACHES OF MAJOR SEARCH ENGINES FOR PUBLICLY
ACCESSIBLE SITES
CHECK FOR DIFFERENCES IN CONTENT BASED ON USER AGENT (EG,
MOBILE SITES, ACCESS AS A SEARCH ENGINE CRAWLER)
PERFORM WEB APPLICATION FINGERPRINTING IDENTIFY
TECHNOLOGIES USED
IDENTIFY USER ROLES
IDENTIFY APPLICATION ENTRY POINTS
IDENTIFY CLIENT-SIDE CODE
IDENTIFY MULTIPLE VERSIONS/CHANNELS (E.G. WEB, MOBILE WEB,
MOBILE APP, WEB SERVICES)
IDENTIFY CO-HOSTED AND RELATED APPLICATIONS
IDENTIFY ALL HOSTNAMES AND PORTS
IDENTIFY THIRD-PARTY HOSTED CONTENT
skilltransform.com 97011 72454
WEB APPLICATION PENETRATION TESTING
CONFIGURATION MANAGEMENT:
CHECK FOR COMMONLY USED APPLICATION AND
ADMINISTRATIVE URLS
CHECK FOR OLD, BACKUP AND UNREFERENCED FILES
CHECK HTTP METHODS SUPPORTED AND CROSS SITE TRACING (XST)
TEST FILE EXTENSIONS HANDLING
TEST FOR SECURITY HTTP HEADERS (E.G. CSP, X-FRAME-OPTIONS,
HSTS)
TEST FOR POLICIES (E.G. FLASH, SILVERLIGHT, ROBOTS)
TEST FOR NON-PRODUCTION DATA IN LIVE ENVIRONMENT,
AND VICE-VERSA
CHECK FOR SENSITIVE DATA IN CLIENT-SIDE CODE (E.G. API
KEYS, CREDENTIALS)
SECURE TRANSMISSION :
CHECK SSL VERSION, ALGORITHMS, KEY LENGTH
CHECK FOR DIGITAL CERTIFICATE VALIDITY (DURATION, SIGNATURE
AND CN)
CHECK CREDENTIALS ONLY DELIVERED OVER HTTPS
CHECK THAT THE LOGIN FORM IS DELIVERED OVER HTTPS
CHECK SESSION TOKENS ONLY DELIVERED OVER HTTPS
CHECK IF HTTP STRICT TRANSPORT SECURITY (HSTS) IN USE
skilltransform.com 97011 72454
WEB APPLICATION PENETRATION TESTING
AUTHENTICATION :
TEST FOR USER ENUMERATION
TEST FOR AUTHENTICATION BYPASS TEST FOR BRUTEFORCE
PROTECTION TEST PASSWORD QUALITY RULES
TEST REMEMBER ME FUNCTIONALITY
TEST FOR AUTOCOMPLETE ON PASSWORD FORMS/INPUT
TEST PASSWORD RESET AND/OR RECOVERY
TEST PASSWORD CHANGE PROCESS TEST CAPTCHA
TEST MULTI FACTOR AUTHENTICATION
TEST FOR LOGOUT FUNCTIONALITY PRESENCE
TEST FOR CACHE MANAGEMENT ON HTTP (EG PRAGMA, EXPIRES,
MAX-AGE) TEST FOR DEFAULT LOGINS
TEST FOR USER-ACCESSIBLE AUTHENTICATION HISTORY
TEST FOR OUT-OF CHANNEL NOTIFICATION OF ACCOUNT LOCKOUTS
AND SUCCESSFUL PASSWORD CHANGES
TEST FOR CONSISTENT AUTHENTICATION ACROSS APPLICATIONS
WITH SHARED AUTHENTICATION SCHEMA / SSO
skilltransform.com 97011 72454
WEB APPLICATION PENETRATION TESTING
SESSION MANAGEMENT :
ESTABLISH HOW SESSION MANAGEMENT IS HANDLED IN THE
APPLICATION (EG, TOKENS IN
COOKIES, TOKEN IN URL)
CHECK SESSION TOKENS FOR COOKIE FLAGS (HTTPONLY AND
SECURE) CHECK SESSION COOKIE SCOPE (PATH AND DOMAIN)
CHECK SESSION COOKIE DURATION (EXPIRES AND MAX-AGE)
CHECK SESSION TERMINATION AFTER A MAXIMUM LIFETIME
CHECK SESSION TERMINATION AFTER RELATIVE TIMEOUT
CHECK SESSION TERMINATION AFTER LOGOUT
TEST TO SEE IF USERS CAN HAVE MULTIPLE SIMULTANEOUS
SESSIONS TEST SESSION COOKIES FOR RANDOMNESS
CONFIRM THAT NEW SESSION TOKENS ARE ISSUED ON LOGIN, ROLE
CHANGE AND LOGOUT
TEST FOR CONSISTENT SESSION MANAGEMENT ACROSS
APPLICATIONS WITH SHARED
SESSION MANAGEMENT
TEST FOR SESSION PUZZLING
TEST FOR CSRF AND CLICKJACKING
AUTHORIZATION :
TEST FOR PATH TRAVERSAL
TEST FOR BYPASSING AUTHORIZATION SCHEMA
TEST FOR VERTICAL ACCESS CONTROL PROBLEMS (A.K.A. PRIVILEGE
ESCALATION)
TEST FOR HORIZONTAL ACCESS CONTROL PROBLEMS (BETWEEN TWO
USERS AT THE SAME PRIVILEGE LEVEL)
TEST FOR MISSING AUTHORIZATION
skilltransform.com 97011 72454
WEB APPLICATION PENETRATION TESTING
DATA VALIDATION :
TEST FOR REFLECTED CROSS SITE SCRIPTING
TEST FOR STORED CROSS SITE SCRIPTING
TEST FOR DOM BASED CROSS SITE SCRIPTING
TEST FOR CROSS SITE FLASHING
TEST FOR HTML INJECTION
TEST FOR SQL INJECTION
TEST FOR SOQL INJECTION
TEST FOR LDAP INJECTION
TEST FOR ORM INJECTION
TEST FOR XML INJECTION
TEST FOR XXE INJECTION
TEST FOR SSI INJECTION
TEST FOR XPATH INJECTION
TEST FOR XQUERY INJECTION
TEST FOR IMAP/SMTP INJECTION
TEST FOR CODE INJECTION
TEST FOR EXPRESSION LANGUAGE INJECTION
TEST FOR COMMAND INJECTION
TEST FOR OVERFLOW (STACK, HEAP AND INTEGER)
TEST FOR FORMAT STRING
skilltransform.com 97011 72454
WEB APPLICATION PENETRATION TESTING
TEST FOR INCUBATED VULNERABILITIES
TEST FOR HTTP SPLITTING/SMUGGLING
TEST FOR HTTP VERB TAMPERING
TEST FOR OPEN REDIRECTION
TEST FOR LOCAL FILE INCLUSION
TEST FOR REMOTE FILE INCLUSION
COMPARE CLIENT-SIDE AND SERVER-SIDE VALIDATION RULES
TEST FOR NOSQL INJECTION
TEST FOR HTTP PARAMETER POLLUTION TEST FOR AUTO-BINDING
TEST FOR MASS ASSIGNMENT
TEST FOR NULL/INVALID SESSION COOKIE CHECK CORS
IMPLEMENTATION
DENIAL OF SERVICE
TEST FOR ANTI-AUTOMATION
TEST FOR ACCOUNT LOCKOUT
TEST FOR HTTP PROTOCOL DOS
TEST FOR SQL WILDCARD DOS
skilltransform.com 97011 72454
WEB APPLICATION PENETRATION TESTING
BUSINESS LOGIC :
TEST FOR FEATURE MISUSE
TEST FOR LACK OF NON-REPUDIATION
TEST FOR TRUST RELATIONSHIPS
TEST FOR INTEGRITY OF DATA
TEST SEGREGATION OF DUTIES
CRYPTOGRAPHY :
CHECK IF DATA WHICH SHOULD BE ENCRYPTED IS NOT
CHECK FOR WRONG ALGORITHMS USAGE DEPENDING ON CONTEXT
CHECK FOR WEAK ALGORITHMS USAGE
CHECK FOR PROPER USE OF SALTING
CHECK FOR RANDOMNESS FUNCTIONS
RISKY FUNCTIONALITY - FILE UPLOADS:
TEST THAT ACCEPTABLE FILE TYPES ARE WHITELISTED
TEST THAT FILE SIZE LIMITS, UPLOAD FREQUENCY AND TOTAL FILE
COUNTS ARE DEFINED AND ARE ENFORCED
TEST THAT FILE CONTENTS MATCH THE DEFINED FILE TYPE
TEST THAT ALL FILE UPLOADS HAVE ANTI-VIRUS SCANNING IN-PLACE.
TEST THAT UNSAFE FILENAMES ARE SANITISED
TEST THAT UPLOADED FILES ARE NOT DIRECTLY ACCESSIBLE WITHIN
THE WEB ROOT
TEST THAT UPLOADED FILES ARE NOT SERVED ON THE SAME
HOSTNAME/PORT
TEST THAT FILES AND OTHER MEDIA ARE INTEGRATED WITH THE
AUTHENTICATION AND AUTHORISATION SCHEMAS
skilltransform.com 97011 72454
WEB APPLICATION PENETRATION TESTING
RISKY FUNCTIONALITY - CARD PAYMENT:
TEST FOR KNOWN VULNERABILITIES AND CONFIGURATION ISSUES
ON WEB SERVER AND WEB APPLICATION
TEST FOR DEFAULT OR GUESSABLE PASSWORD
TEST FOR NON-PRODUCTION DATA IN LIVE ENVIRONMENT, AND
VICE-VERSA
TEST FOR INJECTION VULNERABILITIES
TEST FOR BUFFER OVERFLOWS
TEST FOR INSECURE CRYPTOGRAPHIC STORAGE
TEST FOR INSUFFICIENT TRANSPORT LAYER PROTECTION
TEST FOR IMPROPER ERROR HANDLING
TEST FOR ALL VULNERABILITIES WITH A CVSS V2 SCORE > 4.0
TEST FOR AUTHENTICATION AND AUTHORIZATION ISSUES
TEST FOR CSRF
OWASP TOP 10 WEB APPLICATION :
BROKEN ACCESS CONTROL (A01:2021)
CRYPTOGRAPHIC FAILURES (A02:2021)
INJECTION (A03:2021)
INSECURE DESIGN (A04:2021)
SECURITY MISCONFIGURATION (A05:2021)
VULNERABLE AND OUTDATED COMPONENTS (A06:2021)
IDENTIFICATION AND AUTHENTICATION FAILURES (A07:2021)
SOFTWARE AND DATA INTEGRITY FAILURES (A08:2021)
SECURITY LOGGING AND MONITORING FAILURES (A09:2021)
SERVER-SIDE REQUEST FORGERY (A10:2021)
skilltransform.com 97011 72454
API PENETRATION TESTING
INTRODUCTION TO API SECURITY
UNDERSTAND API TYPES (REST, SOAP, GRAPHQL)
FAMILIARIZE WITH API SPECIFICATIONS AND DOCUMENTATION
IDENTIFY COMMON VULNERABILITIES AND THREAT VECTORS
FAMILIARIZE WITH API SECURITY STANDARDS (OWASP API
SECURITY TOP 10)
SETTING UP THE API TESTING ENVIRONMENT
SET UP TESTING TOOLS SUCH AS POSTMAN, BURP SUITE, AND
OWASP ZAP
CONFIGURE INTERCEPTING PROXY AND SSL CERTIFICATE FOR
HTTPS TESTING
UNDERSTAND API ENDPOINTS, REQUEST METHODS, AND
PARAMETERS FROM API DOCUMENTATION
RECONNAISSANCE AND INFORMATION GATHERING
COLLECT INFORMATION FROM PUBLIC SOURCES (SWAGGER, WSDL
FILES) ENUMERATE ENDPOINTS AND PARAMETERS
IDENTIFY AUTHENTICATION MECHANISMS (TOKENS, COOKIES, ETC.)
MAP OUT API ENDPOINTS AND UNDERSTAND TYPICAL RESPONSES
AUTHENTICATION AND AUTHORIZATION TESTING
TEST FOR WEAK OR MISSING AUTHENTICATION MECHANISMS TEST
FOR API KEY EXPOSURE IN URLS OR HEADERS
BYPASS AUTHENTICATION THROUGH TOKEN MANIPULATION OR
REPLAY ATTACKS CHECK FOR IMPROPER AUTHORIZATION
CONTROLS (ACCESS CONTROLS)
skilltransform.com 97011 72454
API PENETRATION TESTING
INPUT VALIDATION AND INJECTION TESTING
TEST FOR SQL INJECTION, COMMAND INJECTION, AND XML
EXTERNAL ENTITY (XXE) ATTACKS
TEST FOR JAVASCRIPT/JSON INJECTION
(STORED AND REFLECTED XSS)
INJECT SPECIAL CHARACTERS AND PAYLOADS TO TEST FOR INPUT
VALIDATION
CHECK IF INPUT SANITATION AND FILTERING ARE IN PLACE
TESTING FOR RATE LIMITING AND THROTTLING
TEST API ENDPOINTS FOR RATE LIMITING (BRUTE FORCE AND
CREDENTIAL STUFFING)
BYPASS RATE LIMITS BY USING MULTIPLE IPS OR SESSION TOKENS
CHECK IF THE API SERVER HANDLES LOAD ADEQUATELY
SESSION MANAGEMENT AND TOKEN TESTING
TEST FOR ISSUES WITH SESSION EXPIRATION AND LOGOUT
MECHANISMS
VERIFY SECURITY OF SESSION TOKENS AND COOKIES
TEST FOR TOKEN-BASED ATTACKS (JWT MANIPULATION, JWT
REPLAY, CSRF)
VALIDATE IF SECURE FLAGS ARE SET ON COOKIES (HTTPONLY,
SECURE)
skilltransform.com 97011 72454
API PENETRATION TESTING
TESTING FOR DATA EXPOSURE AND INFORMATION DISCLOSURE
CHECK FOR SENSITIVE DATA EXPOSURE (LEAKAGE OF KEYS, TOKENS,
OR CREDENTIALS)
TEST FOR VERBOSE ERROR MESSAGES EXPOSING STACK TRACES OR
SYSTEM INFORMATION
REVIEW HTTP HEADERS FOR UNNECESSARY INFORMATION (SERVER,
X-POWERED-BY)
BROKEN FUNCTION-LEVEL AUTHORIZATION
TEST FOR PERMISSION ESCALATION BY MODIFYING API PARAMETERS
TEST USER ROLES TO ENSURE PROPER ACCESS CONTROL ACROSS
DIFFERENT ENDPOINTS
VERIFY MULTI-TENANT ISOLATION (DATA SHOULD NOT LEAK ACROSS
ACCOUNTS)
BUSINESS LOGIC TESTING
ANALYZE BUSINESS LOGIC FLOWS FOR FLAWS (IMPROPER
WORKFLOWS, ORDERING)
TEST FOR LOGICAL FLAWS THAT COULD LEAD TO FINANCIAL OR DATA
MANIPULATION
CHECK FOR RACE CONDITIONS AND IMPROPER SEQUENCE OF
EVENTS
TESTING FOR SECURITY MISCONFIGURATIONS
VERIFY THAT HTTP METHODS ARE RESTRICTED APPROPRIATELY (NO
INSECURE METHODS LIKE TRACE OR OPTIONS)
TEST IF SENSITIVE ENDPOINTS ARE EXPOSED TO THE PUBLIC
CHECK IF APIS IMPLEMENT SECURE HTTP HEADERS (CSP, HSTS, X-
XSS-PROTECTION)
skilltransform.com 97011 72454
API PENETRATION TESTING
CRYPTOGRAPHIC SECURITY TESTING
VERIFY ENCRYPTION OF SENSITIVE DATA IN TRANSIT AND AT REST
TEST FOR WEAK CRYPTOGRAPHIC ALGORITHMS (MD5, SHA1)
CHECK FOR IMPROPER OR INADEQUATE USE OF ENCRYPTION KEYS
(HARDCODED KEYS)
TOOLS CHECKLIST
GENERAL: POSTMAN, BURP SUITE, OWASP ZAP
RECONNAISSANCE: SWAGGER UI, SOAPUI, POSTMAN
AUTHENTICATION AND AUTHORIZATION: BURP SUITE, POSTMAN
INPUT VALIDATION AND INJECTION TESTING: BURP SUITE, SQLMAP,
OWASP ZAP
SESSION MANAGEMENT: BURP SUITE, JWT.IO
RATE LIMITING: BURP SUITE, CUSTOM SCRIPTS
skilltransform.com 97011 72454
API PENETRATION TESTING
OWASP TOP 10 API SECURITY RISKS – 2023
API1:2023 - BROKEN OBJECT LEVEL AUTHORIZATION
API2:2023 - BROKEN AUTHENTICATION
API3:2023 - BROKEN OBJECT PROPERTY LEVEL AUTHORIZATION
API4:2023 - UNRESTRICTED RESOURCE CONSUMPTION
API5:2023 - BROKEN FUNCTION LEVEL AUTHORIZATION
API6:2023 - UNRESTRICTED ACCESS TO SENSITIVE BUSINESS FLOWS
API7:2023 - SERVER SIDE REQUEST FORGERY
API8:2023 - SECURITY MISCONFIGURATION
API9:2023 - IMPROPER INVENTORY MANAGEMENT API10:2023 -
UNSAFE CONSUMPTION OF APIS
skilltransform.com 97011 72454
Our Recently Placed Students
3 Lpa 4.2 Lpa 4.4 Lpa
Rohini Nilesh Nikhitha
Stick soft Tourbo modus GOVE
3.5 Lpa 4 Lpa 3.4 Lpa
akshay Deepthi Charith
Acunor Cyndin Seguro soft
skilltransform.com 97011 72454
G1 Ground Floor, SS Chambers, plot NO 27, SAP St, Kumar Basti, Gayatri
Nagar, Srinivasa Nagar, Ameerpet, Hyderabad, Telangana 500038
