Courses

  • 41 Lessons

    Cross-Site Scripting (XSS): The 2021 Guide

    Description: In this course, you will develop the skills you need to successfully perform and combat Cross-Site Scripting (XSS) attacks. XSS is one of the top 10 most dangerous and common web application attacks according to both OWASP and CWE. I've spent months creating and collecting the best resources on XSS to put them in this course so that you can learn Cross-Site Scripting in a fun, efficient, and practical manner.

    In order to truly understand how XSS works and how to defend against it, you have to learn hands-on by executing attacks against vulnerable applications and then looking at secure versions of the same code, and that's exactly what you'll do in this course. We start out by explaining the concepts of XSS and its 3 main types: Reflected, Stored (Persistent), and DOM-based. Then, we take a look at case studies of recent real-world XSS vulnerabilities in Facebook, Gmail, Twitter, Tesla, Airbnb, and TikTok. After that, we spin up a lab environment to perform all 3 types of attacks with both manual and automated approaches. We then set up, configure, and use a powerful browser exploitation framework called BeEF to deliver a payload that hooks unsuspecting browsers. From there, you can launch a number of different attacks using BeEF command modules (ie: scanning internal networks, defacing websites, compromising routers, and more). Next, we apply everything we've learned to pentest the OWASP Juice Shop starting with information gathering, and then exploiting all 3 types of XSS. Finally, we wrap up the course by discussing the most (and least) effective defensive controls, including rules, cheat sheets, and recommended code review techniques to properly defend your applications from this dangerous threat.

    If you're looking for a hands-on way to learn Cross-Site Scripting, this is your course!

    Duration: 5h00

    Difficulty: Beginner to Intermediate

    Recommended pre-requisites:

    • Experience working with web applications
    • Experience working with JavaScript

    Topics Covered:

    • Learn what Cross-Site Scripting (XSS) is and how it works
    • Learn the 3 main types of XSS attacks
    • Study recent real-world case studies of XSS vulnerabilities in Facebook, Gmail, Twitter, Tesla, Airbnb, and TikTok
    • Learn hands-on by performing attacks against lab environments
    • Learn to use OWASP ZAP as your proxy (Burp can also be used instead)
    • Learn about filter and defense evasion by looking at various case studies and crafting payloads
    • Learn how to use the powerful browser exploitation framework called BeEF to hook browsers and launch commands remotely
    • Learn defense controls and rules to defend against the 3 main types of XSS

    Testimonials:

    "I've got about 3 years in software security with about 23 years in information and DOD security. While I was familiar with XSS I always thought it was a unique and not so dangerous vulnerability. Your course showed me just how damaging XSS could be, and the various ways to assess and mitigate XSS vulnerabilities. I’ll be incorporating your tools and processes in the way I work with teams to evaluate their products." - Matthew H.

    "This course is great and I would recommend it to anyone trying to learn about web-pentesting or trying to pursue bug bounty as this course gives you a good basis on XSS with a lot of hands-on work." - Bludger
     
  • 25 Lessons

    Injection Attacks: The Free Guide

    4.5+ rating (Udemy) 4.5+ rating (Udemy)

    Description: In this course, we explore the biggest risk facing web applications: injections. While we will focus primarily on SQL injections, there are other types of injections such as OS command, LDAP, XPATH, XML, and SMTP header injections, which are all listed in the OWASP Top 10 risks. In order to truly understand how injections work, we have to learn hands-on by executing attacks against vulnerable applications, and that's exactly what we'll do in this course. We start out by setting up safe and legal environments, and then we go on the offense exploring each successful and unsuccessful attack to understand what's going on, and ultimately, how to protect our apps against such vulnerabilities. So if you're looking for hands-on learning, this is your course!

    Duration: ~4 hours

    Difficulty: Beginner to Intermediate

    Recommended pre-requisites:

    Topics Covered:

    • Explore the power of injections as listed by OWASP in their top 10 risks (including SQL injections)
    • Follow along as we attack applications legally & safely
    • Learn defense controls against injections
  • 26 Lessons

    Introduction to Application Security (AppSec)

    4.3+ rating 4.3+ rating (Udemy)

    Description: In this course, we provide a thorough yet high-level understanding of Application Security concepts as they relate to web, mobile, and cloud-based applications. It is intended to provide a foundational overview of core concepts so that you can dive deeper into those respective areas of interest.

    Duration: ~3 hours

    Difficulty: Beginner

    Pre-Requisites:

    • Experience: 2+ years of general programming
    • Courses: None

    Topics Covered:

    • Core concepts of AppSec
    • Important frameworks & tools to help create more secure software
    • OWASP for Web & Mobile applications
    • Cloud application security concepts
    • Application Security testing methodologies
    • Hands-on pentesting demonstrations
  • 10 Lessons

    Introduction to OS Command Injections

    4.5+ rating 4.5+ rating (Udemy)

    Description: OS Command Injections are part of the OWASP Top 10 Web Application Security Risks, and as you will see in this course, this threat can result in serious damages if left unchecked. We start out by creating a safe and legal environment for us to perform attacks in. Then, we cover the core concepts of command injections and learn about techniques that can be used to exploit vulnerable targets. After that, we go full-on offensive and perform manual injection attacks as well as automated attacks with a tool called Commix. Once we find vulnerabilities, we generate and plant persistent backdoors that can be exploited to create shells with MSFvenom and Weevely, giving us access to the target server any time we want. After successfully attacking and compromising our targets, we take a step back and discuss defensive controls at the application layer. We also look at actual vulnerable code and show ways of fixing that vulnerable code to prevent injections. Since OS Command injections can be used to exploit most systems running an operating system, such as: web servers, IoT devices, office devices (ie: printers), and more, this is an important threat to understand as an application developer or IT business leader.

    Duration: 1 hour 15 minutes

    Difficulty: Beginner to Intermediate

    Recommended pre-requisites:

    • Experience working with web applications
    • Experience with OS commands (Linux or Windows)

    Topics Covered:

    • Explore the threat of OS Command injections as listed by OWASP in their top 10 web risks (Injections)
    • Follow along as we attack applications legally & safely
    • Generate, upload, and use backdoor shells with MSFvenom and Weevely
    • Learn defensive controls that can be applied to your applications