Secure Coding Java - Spring Edition

Algemene omschrijving

This course is entirely in English.

The course Secure Coding Java - Spring Edition allows you to develop advanced theoretical and practical skills for the development of secure web applications, regardless of the programming language used, with reference to OWASP best practices.

The theoretical content will be supplemented with examples and practical labs in the Java language and the use of the Spring framework.

Doelgroep

The objective of the course Secure Coding Java - Spring Edition is to standardize skills in the web application security field among all team members, as well as to help developers understand the perspective of an attacker.

The reference language used is Java, along with the Spring framework.

Leerdoelen

The course Secure Coding Java - Spring Edition is designed for Java developers who want to deepen their knowledge of web application security best practices.

Onderwerpen

Day 1

• Introduction to Secure Coding.
  • Software Robustness, Performance, and Security.
  • Primary Causes of Vulnerabilities.
  • OWASP Methodology for Secure Coding and Code Review.
  • OWASP Methodology for WAPT.
• Secure SDLC (Software Development Life Cycle).
  • Security Bug Costs.
  • Risk and Impact Concepts.
  • Discussion regarding each phase of the Secure SDLC.
• Black Box Testing vs Code Review.
• Secure Coding Principles.
• BurpSuite Introductions.
• Bug bounties.
• Vulnerability & Attacks.
  • Information Gathering.
    • Application Fingerprinting.
    • Content Discovery.
    • Recon Tools.
  • Improper Error Handling.

Day 2

• Injection.
  • SQL Injection.
  • LDAP Injection.
  • XPath Injection.
  • XML Injection.
  • Command Injection.
  • Path Traversal.
  • Log Forging.
  • HTTP Splitting.

Day 3

• Authentication.
  • User enumeration.
  • Authentication Bypass.
  • Default Credentials.
  • Change & Reset Password functionalities.
• Authorization.
  • Authorization Bypass.
  • Parameter Manipulation.
  • Access Matrix.
• Application Logic Bypass.
• JWT.

Day 4

• Sensitive Data Exposure On Transit.
  • SSL/TLS.
  • Weak Cipher Suites.
  • Padding Oracle.
• Sensitive Data Exposure At Rest.
  • Symmetric & Asymmetric Encryption Algorithms.
  • Hashing.
  • Salt.
• REST API Security.
• Data Validation.
  • Cross-Site Scripting.
  • Whitelisting vs Blacklisting.
  • Output Encoding.
• Open redirect.
• Arbitrary file upload.
• Vulnerable Components.
• XXE.
  • In band.
  • Out of band.

Day 5

• Session Handling.
  • CSRF.
  • Session ID Randomness.
  • Session Fixation.
• CORS Security.
• SSRF.
• CSP.
• Other vulnerabilities.
  • Clickjacking.
  • Denial of Service.
• Software and data integrity failures.
• Spring Boot & Spring Security.
• Spring Security vs .NET Security.