Bonsai and NopSec have partnered to deliver the second w3af ninja training course in New York City.

The w3af ninja training course is focused on manual and automated discovery and exploitation of web application vulnerabilities using w3af. During this course you’ll also learn how to write your own exploits and customized plugins in order to achieve your goals during a web application penetration test.

This course is an intense hands-on class in which you won’t stop learning for a minute. In each practice we’ll focus on a particular type of web application vulnerability which will be analyzed and understood manually and then it’s detection and exploitation is automated using w3af.

All around the training interesting plugin code snippets will be subject to analysis and modification, which will give you great understanding of the framework and will also give you the means to automate your future web application penetration tests.

Important information

• Date: December 17th / 18th 2009
• Training partners: NopSec, Inc. SOC – 155 Water St., Brooklyn, NY 11201 USA
• More information, and registration is available here.

This is a great opportunity to master the w3af framework, don’t miss it!

andres.riancho bonsai, security, w3af bonsai, nopsec, NYC, training, w3af

I’m going to be delivering a Web Application Security training at FRHACK next September 2009! FRHACK is a highly technical, non-business conference that is going to be held at Besançon, France. The training is a two day, hands-on class where the w3af project leader will train you in the techniques and methodologies needed to discover and exploit web application vulnerabilities.

Here is some extra information regarding the training,

Training name: Discovery and exploitation of web application vulnerabilities

Overview

This training course focus is on manual and automated, discovery and exploitation of web application vulnerabilities. During this course you are going to go through a series of lectures followed by hands on practice. In each practice you will find vulnerabilities to exploit, each with a different level of complexity, which will defy your understanding of the subject. After the hands on practice, a small lecture on how the vulnerability is fixed is presented, together with common errors introduced by developers in that process.

The training will also teach you how to use the most advanced tools used by professionals in the field, like w3af (developed by the trainer), the burp suite, sqlmap and many others.

Course Structure

This is a two-day course that combines lectures with increasingly difficult hands-on exercises designed to teach the attendee different ways to discover and exploit web application vulnerabilities. All course materials, and a certificate of completion will be offered. You must provide your own laptop.

Deliverables

- Training booklet with printed slides and trainer comments
- Live CD with Web Application Security Tools
- VMware image with the training environment
- w3af T-Shirt ;)

Audience

Security consultants, system and network administrators, experienced web application developers, information security officers, government agencies.

Topics Covered

• Day One
  1. HTTP protocol review
     • Web architecture
     • HTTP headers and methods
     • HTTP authentication
     • HTTPS
     • Session management: cookies
  2. Common web server misconfigurations
     • Banners
     • Directory Indexing
     • HTTP authentication
     • HTTP method restrictions
  3. Common development and configuration errors
     • HTML comments and versioning
     • File inclusions
     • Backup and local database files
     • Hidden HTML Fields
     • Path Disclosure and directory enumeration
     • Exceptions and error messages
  4. Types of analysis
     • Static code analysis, black box testing and gray box testing:
     • Definitions
     • Vulnerabilities that can be detected
     • Vulnerabilities that CAN’T be detected
  5. Web Application Vulnerabilities
     • Reverse engineering of Java applets y Flash movies
     • Local file read
     • Local file inclusions
     • Path Traversal and Null Bytes
     • Remote file inclusions
     • Cross Site Scripting (XSS)
     • Cross Site Tracing
     • Cross Site Request Forgeries / Session Riding
     • HTTP Response Splitting
• Day Two
  1. Web Application Vulnerabilities
     • Uncommon attack vectors
     • LDAP Injection
     • OS Commanding
     • SQL Injection:
       • Enumeration of tables and columns
       • Execution of queries and stored procedures
       • Creation of files
       • Execution of OS commands
     • Blind SQL Injection
  2. Web application privilege escalation
     • Session handling
     • Logical vulnerabilities
  3. Countermeasures
     • mod_security
     • Hardening for Java
       • HDIV
       • Spring Security
     • PHP hardening:
       • Secure configuration parameters
       • GRASP
       • PHP-IDS

andres.riancho bonsai, conferences france, september, training, w3af, web

Moth is a VMware image with a set of vulnerable Web Applications and scripts, that you may use for:

• Testing Web Application Security Scanners
• Testing Static Code Analysis tools (SCA)
• Giving an introductory course to Web Application Security

The motivation for creating this tool came after reading “anantasec-report.pdf” which is included in the release file which you are free to download. The main objective of this tool is to give the community a ready to use testbed for web application security tools. For almost every web application vulnerability in existance, there is a test script available in moth.

Other tools like this are available but they lack one very important feature: a list of vulnerabilities included in the Web Applications! In our case, we used the results gathered in the anantasec report to solve this issue without any extra work.

There are three different ways to access the web applications and vulnerable scripts:

• Directly
• Through mod_security
• Through PHP-IDS (only if the web application is written in PHP)

Both mod_security and PHP-IDS have their default configurations and they show a log of the offending request when one is found. This is very useful for testing web application scanners, and teaching students how web application firewalls work. The beauty is that a user may access the same vulnerable script using the three methods; which helps a lot in the learning process.

Click here to download moth from sourceforge.

andres.riancho open source gpl, mod_security, open source, PHP-IDS, training, vmware, w3af, WAF, Web Application Security

Bonsai and NopSec have partnered to deliver a w3af ninja training course in New York City.

The w3af ninja training course is focused on manual and automated discovery and exploitation of web application vulnerabilities using w3af. During this course you’ll also learn how to write your own exploits and customized plugins in order to achieve your goals during a web application penetration test.

This course is an intense hands-on class in which you won’t stop learning for a minute. In each practice we’ll focus on a particular type of web application vulnerability which will be analyzed and understood manually and then it’s detection and exploitation is automated using w3af.

All around the training interesting plugin code snippets will be subject to analysis and modification, which will give you great understanding of the framework and will also give you the means to automate your future web application penetration tests.

Important information

• Date: June 17th / 18th 2009
• Training partners: NopSec, Inc. SOC – 155 Water St., Brooklyn, NY 11201 USA
• More information, and registration is available here.

This is a great opportunity to master the w3af framework, don’t miss it!

andres.riancho bonsai, security, w3af bonsai, june, new york, nopsec, ny, training, w3af

Well, it seems that I’m going to be traveling a lot this year ;) I’ve just talked with the CONFidence conference organizers and we decided that it would be nice to deliver two different trainings at CONFidence:

• w3af ninja
• Discovery and exploitation of web application vulnerabilities

Both trainings are hands on, and will be 7 hours long (with a one hour meal break in between), the prices are really affordable, only 300€ each, so I expect a crowded class. Please register early because the seats are limited!

I’m really looking forward to the w3af training, it’s going to be the first time I deliver that particular training at a conference. The adrenaline rush will be higher than usual, as I see more and more people getting interested in w3af as an every-day tool that they can use during their penetration test engagements.

admin conferences bonsai, training, w3af, web