Security testing Java Web applications (STJWA)

Day 1

• Cyber security basics
  • What is security?
  • Threat and risk
  • Cyber security threat types – the CIA triad
  • Consequences of insecure software
• Security testing
  • Security testing vs functional testing
  • Manual and automated methods
  • Black box, white box, and hybrid testing
• The OWASP Top Ten 2021
  • A01 – Broken Access Control
    • Access control basics
    • Case study – Broken authn/authz in Apache OFBiz
    • Testing for authorization issues
    • Confused deputy
    • Insecure direct object reference (IDOR)
    • Lab – Insecure Direct Object Reference
    • Path traversal best practices
    • Authorization bypass through user-controlled keys
    • Case study – Remote takeover of Nexx garage doors and alarms
    • Lab – Horizontal authorization
    • Testing for confused deputy weaknesses
    • Lab – IDOR fuzzing with DotDotPwn
  • A03 – Injection
    • Injection principles
    • Injection attacks
    • SQL injection
      • SQL injection basics
      • Lab – SQL injection
      • Attack techniques
        • Content-based blind SQL injection
        • Time-based blind SQL injection
      • Testing for SQL injection
      • Testing SQL injection
      • SQL injection tools
      • Lab – Using SQL injection tools
      • SQL injection best practices
      • Input validation
      • Parameterized queries
      • Lab – Using prepared statements
      • Case study – SQL injection in Fortra FileCatalyst
    • Code injection
      • OS command injection
      • OS command injection best practices
      • Using Runtime.exec()
      • Case study – Shellshock
      • Lab – Shellshock
      • Case study – Command injection in VMware Aria
      • Testing for command injection

  Day 2

  • The OWASP Top Ten 2021
    • A03 – Injection (continued)
      • Input validation
        • Input validation principles
        • Denylists and allowlists
        • What to validate – the attack surface
        • Where to validate – defense in depth
        • When to validate – validation vs transformations
        • Validation with regex
        • Regular expression denial of service (ReDoS)
        • Lab – ReDoS
        • Dealing with ReDoS
      • HTML injection – Cross-site scripting (XSS)
        • Cross-site scripting basics
        • Cross-site scripting types
          • Persistent cross-site scripting
          • Reflected cross-site scripting
          • Client-side (DOM-based) cross-site scripting
        • Lab – Stored XSS
        • Lab – Reflected XSS
        • Testing for XSS
        • Testing for XSS with tools
        • Lab – Using XSS testing tools
        • XSS protection best practices
        • Protection principles – escaping
        • Lab – XSS fix / stored
        • Lab – XSS fix / reflected
        • Case study – XSS vulnerabilities in DrayTek Vigor routers
    • Security testing
      • Security testing methodology
      • Security testing – goals and methodologies
      • Overview of security testing processes
      • Identifying and rating assets
        • Preparation and scoping
        • Identifying assets
        • Identifying the attack surface
        • Assigning security requirements
        • Lab – Identifying and rating assets
      • Threat modeling
        • Attacker profiling
        • SDL threat modeling
        • Mapping STRIDE to DFD
        • DFD example
        • Lab – SDL threat modelling with OWASP Threat Dragon
      • Attack trees
        • Attack tree example
        • Lab – Crafting an attack tree
      • Misuse cases
        • Misuse case examples
      • Risk analysis
        • Lab – Risk analysis
      • Accomplishing the tests
      • Reporting, recommendations, and review
    • A04 – Insecure Design
      • Client-side security
      • Frame sandboxing
      • Cross-Frame Scripting (XFS) attacks
      • Lab – Clickjacking
      • Clickjacking protection best practices
      • Lab – Using CSP to prevent clickjacking
      • Testing for client-side security weaknesses

  Day 3

  • A07 – Identification and Authentication Failures
    • Session management
      • Session management essentials
      • Why do we protect session IDs – Session hijacking
      • Session fixation
      • Session ID best practices
      • Testing for session management issues
    • Password management
      • Inbound password management
      • Storing account passwords
      • Password in transit
      • Lab – Is just hashing passwords enough?
      • Dictionary attacks and brute forcing
      • Salting
      • Adaptive hash functions for password storage
      • Lab – Using adaptive hash functions in JCA
      • Password policy
      • NIST authenticator requirements for memorized secrets
      • Password database migration
      • Testing for password management issues
      • Using password cracking tools
      • Password cracking in Windows
      • Lab – Password audit with John the Ripper
  • A08 – Software and Data Integrity Failures
    • Subresource integrity
    • Importing JavaScript
    • Lab – Importing JavaScript
    • Case study – The British Airways data breach
    • Testing for subresource integrity
    • Insecure deserialization
      • Serialization and deserialization challenges
      • Integrity – deserializing untrusted streams
      • Integrity – deserialization best practices
      • Look ahead deserialization
      • Testing for insecure deserialization
      • Property Oriented Programming (POP)
      • Creating a POP payload
      • Lab – Creating a POP payload
      • Lab – Using the POP payload
      • Case study – Deserialization RCEs in NextGen Mirth Connect
      • Summary – POP best practices
  • A09 – Security Logging and Monitoring Failures
    • Logging and monitoring principles
    • Insufficient logging
    • Case study – Plaintext passwords at Facebook
    • Log forging
    • Web log forging
    • Lab – Log forging
    • Log forging – best practices
    • Case study – Log interpolation in log4j
    • Case study – The Log4Shell vulnerability (CVE-2021-44228)
    • Case study – Log4Shell follow-ups (CVE-2021-45046, CVE-2021-45105)
    • Lab – Log4Shell
    • Logging best practices
    • Testing for logging issues
    • Monitoring best practices
  • A10 – Server-side Request Forgery (SSRF)
    • Server-side Request Forgery (SSRF)
    • Case study – SSRF in Ivanti Connect Secure
    • Testing for SSRF
  • Security testing
    • Security testing techniques and tools
    • Code analysis
      • Static Application Security Testing (SAST)
      • Lab – Using static analysis tools
    • Dynamic analysis
      • Security testing at runtime
      • Penetration testing
      • Stress testing
      • Dynamic analysis tools
      • Dynamic Application Security Testing (DAST)
      • Web vulnerability scanners
      • Lab – Using web vulnerability scanners
    • Fuzzing
  • Wrap up
    • Secure coding principles
    • Principles of robust programming by Matt Bishop
    • Secure design principles of Saltzer and Schroeder
    • And now what?
    • Software security sources and further reading
    • Java resources
    • Security testing resources