Security of internet applications Training Course

Upon completing this training, participants will be capable of:

• Explaining application security and potential vulnerabilities
• Describing ABAP programming best practices and the handling of SY-SUBRC
• Understanding injection vulnerabilities
• Describing security testing tools
• Explaining ATC and CVA

Course Format

• Interactive lectures and discussions
• Extensive exercises and practical work
• Hands-on implementation in a live-lab environment

This course addresses the essential secure coding topics pertinent to a wide range of web application developers. It instructs students on the principles of secure programming by examining specific code snippets, identifying security vulnerabilities, and implementing corrective measures.

Participants will observe demonstrations of real-world attacks and learn effective prevention strategies, building confidence as they work to enhance their applications' security.

Duration: 3 days
Who Should Attend: Developers seeking to expand their expertise in secure coding.

Upon Completion
• Students will gain knowledge in:
• Web Application Security.
• Common Web Application Risks.
• Demo Web Application Penetration Testing.
• Data Validation.
• Authentication.
• Session Management.
• Secure SDLC.

Android serves as an open platform for mobile devices, including smartphones and tablets. While it offers a wide array of security features designed to facilitate the development of secure software, it also lacks certain security aspects found in other handheld platforms. This course provides a comprehensive overview of these features and highlights critical shortcomings related to the underlying Linux system, the file system, and the general environment, as well as those associated with permissions and other Android software development components.

Common security pitfalls and vulnerabilities are explained for both native code and Java applications, accompanied by recommendations and best practices to prevent and mitigate these issues. The topics discussed are often supported by real-life examples and case studies. Finally, the course briefly covers how to utilize security testing tools to identify security-related programming bugs.

Participants attending this course will

• Understand the fundamental concepts of security, IT security, and secure coding
• Learn about security solutions on Android
• Learn to use various security features of the Android platform
• Gain information about recent Java vulnerabilities on Android
• Learn about typical coding mistakes and how to avoid them
• Understand native code vulnerabilities on Android
• Recognize the severe consequences of insecure buffer handling in native code
• Understand architectural protection techniques and their weaknesses
• Access sources and further readings on secure coding practices

Audience

Professionals

Developing a secure networked application is challenging, even for developers familiar with cryptographic building blocks like encryption and digital signatures. To help participants grasp the role and application of these cryptographic primitives, the course establishes a solid foundation on the core requirements of secure communication: secure acknowledgment, integrity, confidentiality, remote identification, and anonymity. It also highlights common threats to these requirements and presents real-world solutions.

Given that cryptography is a critical component of network security, the course examines the most important cryptographic algorithms in symmetric cryptography, hashing, asymmetric cryptography, and key agreement. Rather than focusing on complex mathematical theories, these topics are approached from a developer’s perspective, featuring typical use-case examples and practical considerations such as public key infrastructures. The course introduces security protocols used in various areas of secure communication, with an in-depth exploration of widely adopted protocol families like IPSEC and SSL/TLS.

Typical cryptographic vulnerabilities are discussed, both concerning specific algorithms and protocols. Examples include BEAST, CRIME, TIME, BREACH, FREAK, Logjam, Padding oracle, Lucky Thirteen, POODLE, and RSA timing attacks. For each issue, practical implications and potential consequences are explained without delving into deep mathematical details.

Finally, as XML technology is central to data exchange in networked applications, the course covers XML security. This includes the use of XML in web services and SOAP messages, alongside protection mechanisms like XML signature and XML encryption. The course also addresses weaknesses in these protection measures and XML-specific security issues such as XML injection, XML external entity (XXE) attacks, XML bombs, and XPath injection.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Understand the requirements of secure communication
• Learn about network attacks and defenses at different OSI layers
• Gain a practical understanding of cryptography
• Understand essential security protocols
• Understand some recent attacks against cryptosystems
• Get information about some recent related vulnerabilities
• Understand security concepts of Web services
• Get sources and further readings on secure coding practices

Audience

Developers, Professionals

This three-day course provides an overview of securing C/C++ code against malicious actors who may exploit vulnerabilities related to memory management and input handling. The course emphasizes the core principles of writing secure code.

Even seasoned Java developers often do not fully master the diverse security services provided by Java, and may remain unaware of the various vulnerabilities pertinent to web applications built with Java.

Beyond introducing the security components of Standard Java Edition, this course addresses security challenges in Java Enterprise Edition (JEE) and web services. Discussions on specific services are preceded by foundational knowledge of cryptography and secure communication. A range of hands-on exercises explores both declarative and programmatic security techniques within JEE, while also covering transport-layer and end-to-end security for web services. Participants will gain practical experience by applying the discussed APIs and tools through multiple real-world scenarios.

The course further examines the most common and critical programming flaws inherent to the Java language and platform, as well as web-related vulnerabilities. In addition to typical coding mistakes made by Java developers, the introduced security issues encompass language-specific problems and those arising from the runtime environment. Each vulnerability and associated attack vector is illustrated through clear, easy-to-follow exercises, followed by recommended coding practices and effective mitigation strategies.

Participants attending this course will

• Grasp fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and understand how to prevent them
• Comprehend security concepts specific to web services
• Learn how to leverage various security features within the Java development environment
• Acquire practical knowledge of cryptography
• Understand security solutions available in Java EE
• Identify typical coding errors and learn how to avoid them
• Gain insight into recent vulnerabilities affecting the Java framework
• Develop practical skills in using security testing tools
• Access resources and further reading materials on secure coding practices

Audience

Developers

Description

The Java programming language and the Java Runtime Environment (JRE) were engineered to minimize exposure to the most critical security vulnerabilities commonly found in other languages such as C and C++. However, software developers and architects must possess a dual understanding: they should master the positive aspects of Java's built-in security features while remaining vigilant about the negative security risks—known vulnerabilities that continue to impact Java development.

To facilitate the effective use of security services, this course begins with a concise overview of cryptography fundamentals. This establishes a common baseline for comprehending the purpose and functionality of the relevant components. Participants will then engage in practical exercises to apply and explore these APIs firsthand.

The curriculum also addresses the most frequent and severe programming flaws associated with the Java language and platform. This includes both typical errors made by Java developers and issues specific to the language and its environment. Each vulnerability and its corresponding attack vector are illustrated through accessible exercises, followed by recommended coding guidelines and effective mitigation strategies.

Participants attending this course will

• Grasp the fundamental concepts of security, IT security, and secure coding principles
• Identify and learn to prevent web vulnerabilities that extend beyond the OWASP Top Ten list
• Gain proficiency in utilizing the diverse security features available within the Java development environment
• Develop a practical understanding of cryptographic concepts and applications
• Recognize common coding mistakes and learn strategies to avoid them
• Gain insights into recent vulnerabilities affecting the Java framework
• Access recommended resources and further readings on secure coding practices

Audience

Developers

Today, numerous programming languages can compile code for the .NET and ASP.NET frameworks. While this environment offers robust security development capabilities, developers must understand how to apply architecture- and code-level techniques to implement desired security functions, prevent vulnerabilities, and mitigate their exploitation.

This course aims to train developers through extensive hands-on exercises. Participants will learn how to prevent untrusted code from executing privileged actions, protect resources using strong authentication and authorization, manage remote procedure calls and sessions, explore various implementation strategies for specific functionalities, and more.

The course introduces different vulnerabilities by highlighting typical programming errors made when using .NET. The discussion on ASP.NET vulnerabilities also covers various environment configurations and their impacts. Furthermore, the section on ASP.NET-specific vulnerabilities addresses both general web application security challenges and specialized issues, such as ViewState attacks and string termination attacks.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to avoid them
• Master the use of various security features within the .NET development environment
• Gain practical knowledge in using security testing tools
• Identify typical coding mistakes and learn how to prevent them
• Receive information on recent vulnerabilities in .NET and ASP.NET
• Access resources and further readings on secure coding practices

Audience

Developers

This course introduces fundamental security concepts, provides an overview of the nature of vulnerabilities across different programming languages and platforms, and explains how to manage software security risks throughout the various phases of the software development lifecycle. Without delving too deeply into technical details, it highlights some of the most critical and pressing vulnerabilities found in diverse software development technologies. Additionally, it presents the challenges associated with security testing, along with practical techniques and tools that can be applied to identify existing issues within code.

Participants attending this course will

• Understand basic concepts of security, IT security, and secure coding
• Understand web vulnerabilities on both the server and client sides
• Recognize the severe consequences of insecure buffer handling
• Be informed about recent vulnerabilities in development environments and frameworks
• Learn about typical coding mistakes and how to avoid them
• Understand security testing approaches and methodologies

Audience

Managers

This course equips PHP developers with the essential skills required to harden their applications against contemporary internet-based threats. It explores web vulnerabilities through practical PHP examples, extending beyond the OWASP Top Ten to cover various injection attacks, script injections, session handling weaknesses, insecure direct object references, file upload issues, and more. PHP-related vulnerabilities are categorized into standard types such as missing or incorrect input validation, improper error and exception handling, misuse of security features, and time- and state-related problems. Specific attacks discussed include open_basedir circumvention, denial-of-service via magic floats, and hash table collision attacks. Participants will learn the key techniques and functions needed to mitigate these risks.

A significant emphasis is placed on client-side security, addressing vulnerabilities in JavaScript, Ajax, and HTML5. The course introduces several PHP security extensions, such as hash, mcrypt, and OpenSSL for cryptography, as well as Ctype, ext/filter, and HTML Purifier for input validation. Best practices for hardening are provided in the context of PHP configuration (php.ini), Apache, and server-level settings. Additionally, the course offers an overview of various security testing tools and techniques, including security scanners, penetration testing, exploit packs, sniffers, proxy servers, fuzzing tools, and static source code analyzers.

Both the introduction of vulnerability concepts and configuration practices are reinforced with hands-on exercises. These exercises demonstrate the impact of successful attacks, guide participants on applying mitigation strategies, and introduce the use of various extensions and tools.

Participants attending this course will

• Understand fundamental concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and how to prevent them
• Gain insight into client-side vulnerabilities and secure coding practices
• Develop a practical understanding of cryptography
• Learn to utilize various PHP security features
• Identify typical coding errors and learn how to avoid them
• Stay informed about recent vulnerabilities in the PHP framework
• Acquire practical experience using security testing tools
• Access resources and further reading on secure coding practices

Audience

Developers

Combined SDL core training provides insight into secure software design, development, and testing through the Microsoft Secure Development Lifecycle (SDL). It offers a Level 100 overview of the fundamental building blocks of SDL, followed by design techniques to detect and resolve flaws in the early stages of the development process.

Focusing on the development phase, the course presents an overview of typical security-relevant programming bugs in both managed and native code. Attack methods for the discussed vulnerabilities are presented alongside associated mitigation techniques, all explained through a series of hands-on exercises that provide live hacking experiences for participants. An introduction to various security testing methods is followed by demonstrations of the effectiveness of different testing tools. Participants can understand the operation of these tools through practical exercises by applying them to the previously discussed vulnerable code.

Participants attending this course will

Understand basic concepts of security, IT security, and secure coding

Become familiar with the essential steps of the Microsoft Secure Development Lifecycle

Learn secure design and development practices

Learn about secure implementation principles

Understand security testing methodology

• Access sources and further readings on secure coding practices

Audience

Developers, Managers

Following an introduction to common vulnerabilities and attack vectors, participants explore the overarching methodology and general approach for conducting security testing. They also examine techniques designed to uncover specific flaws. Effective security testing begins with comprehensive information gathering regarding the system under evaluation (Target of Evaluation, or ToC). This is followed by thorough threat modeling to identify and prioritize threats, ultimately leading to a risk analysis-driven test plan.

Security evaluations occur at various stages of the Software Development Life Cycle (SDLC). Consequently, the course covers design reviews, code reviews, reconnaissance, and system information gathering. It also addresses testing the implementation and hardening the environment for secure deployment. Detailed attention is given to numerous security testing techniques, including taint analysis, heuristics-based code review, static code analysis, dynamic web vulnerability testing, and fuzzing. Participants are introduced to various tools used to automate the security evaluation of software products. These concepts are reinforced through practical exercises where these tools are applied to analyze previously discussed vulnerable code. Additionally, real-life case studies are utilized to deepen the understanding of diverse vulnerabilities.

This course equips testers and QA professionals with the ability to effectively plan and precisely execute security tests. Participants will learn to select and utilize the most suitable tools and techniques to identify even hidden security flaws, acquiring essential practical skills ready for immediate application in their professional roles.

Participants attending this course will

• Grasp fundamental concepts of security, IT security, and secure coding
• Master web vulnerabilities beyond the OWASP Top Ten and learn how to prevent them
• Gain knowledge of client-side vulnerabilities and secure coding practices
• Comprehend security testing approaches and methodologies
• Acquire practical experience in applying security testing techniques and tools
• Access resources and further reading materials on secure coding practices

Audience

Developers, Testers

Protecting applications accessible via the web demands security professionals who are consistently up-to-date with current attack methods and trends. While a wide variety of technologies and environments facilitate comfortable web application development, it is crucial to remain aware not only of security issues specific to these platforms but also of general vulnerabilities that apply regardless of the development tools used.

This course provides an overview of applicable security solutions for web applications, with a special emphasis on understanding the most critical cryptographic measures. It covers web application vulnerabilities on both the server side (following the OWASP Top Ten) and the client side, illustrated through relevant attacks. The course then presents recommended coding techniques and mitigation strategies to prevent these issues. The topic of secure coding concludes with a discussion of common security-related programming mistakes, such as issues with input validation, improper use of security features, and code quality.

Testing plays a vital role in ensuring the security and robustness of web applications. Various approaches, ranging from high-level auditing and penetration testing to ethical hacking, can be employed to uncover different types of vulnerabilities. However, to go beyond easily accessible low-hanging fruits, security testing must be well-planned and executed properly. It is important to remember that while security testers should ideally find all bugs to protect a system, adversaries only need to find one exploitable vulnerability to penetrate it.

Practical exercises are designed to help participants understand web application vulnerabilities, programming mistakes, and, most importantly, mitigation techniques. Through hands-on trials with various testing tools—such as security scanners, sniffers, proxy servers, fuzzing tools, and static source code analyzers—this course delivers essential practical skills that can be immediately applied in the workplace the following day.

Participants attending this course will

• Understand the basic concepts of security, IT security, and secure coding
• Learn about web vulnerabilities beyond the OWASP Top Ten and know how to avoid them
• Learn about client-side vulnerabilities and secure coding practices
• Gain a practical understanding of cryptography
• Understand security testing approaches and methodologies
• Acquire practical knowledge of using security testing techniques and tools
• Stay informed about recent vulnerabilities in various platforms, frameworks, and libraries
• Access sources and further reading materials on secure coding practices

Audience

Developers, Testers

This course is designed for software developers, testers, and architects involved in creating software using various programming languages and platforms, including desktop, web, cloud, and mobile. It aims to enhance their ability to produce high-quality software, with a particular focus on security and privacy.

In this instructor-led, live course in Uzbekistan, participants will learn how to develop an effective security strategy to address the challenges of DevOps security.