課程簡介
Burp Suite Professional in the IT Audit Process
- Tool role across planning, fieldwork and reporting
- Manual validation versus automated scanning
- Rules of engagement and testing authorization
Workspace Configuration, Scope and Traffic Capture
- Proxy, browser and TLS setup
- Scope rules and out-of-scope protection
- Project files and session handling for evidence
HTTP/HTTPS Traffic Analysis and Application Mapping
- Request and response structure, headers and cookies
- Site map, content discovery and hidden endpoints
- API and JSON traffic review
Security Configuration and Transport Control Validation
- Header, cookie and CORS configuration review
- TLS settings, HTTP methods and error disclosure
- Comparison against agreed configuration baselines
Authentication Control Testing
- Login, MFA and credential policy behaviour
- Session tokens, fixation and logout handling
- Token and JWT validation weaknesses
Authorization and Access Control Testing
- Horizontal and vertical privilege testing across roles
- Insecure direct object references and forced browsing
- Role matrix evidence and side-by-side comparison
Injection, Input Handling and Out-of-Band Validation
- Injection confirmation without destructive payloads
- Cross-site scripting and client-side sink testing
- Blind and out-of-band cases with Collaborator
Business Logic and Workflow Testing
- Multi-step workflow and sequence enforcement
- Price, quantity and approval parameter tampering
- Replay, race conditions and repeat-action abuse
Scanner-Assisted Coverage, Extensions and AI Assistance
- Crawl and audit configuration for scoped coverage
- Issue triage and false positive validation
- Custom checks with BChecks and extensions
- Burp AI and agentic testing with data handling limits
Evidence Collection and Audit Documentation
- Request and response evidence with timestamps
- Redaction of sensitive data and evidence handling
- Mapping findings to OWASP Top 10:2025, WSTG and CWE
- Risk rating with CVSS v4.0 and audit criteria
Capstone: End-to-End Web Application Control Assessment
- Scoped assessment of a training application
- Workpapers, findings register and closing debrief
最低要求
- Experience in IT auditing and IT security assessment
- Working knowledge of technology risk, security controls and network protocols
- Familiarity with HTTP/HTTPS and the OWASP framework
- Basic to intermediate use of web security testing tools such as Kali Linux and OWASP ZAP
Audience
- Senior and semi-senior IT auditors
- Technology risk and security control assessors
客戶評論 (2)
培訓幫助我擴展了對Burp Suite的知識和理解。我也意識到,通過自學學到的內容仍然相當有限。這次培訓對作為QA的我非常有幫助,因為Burp Suite是執行安全測試和提升應用程式測試整體品質的寶貴工具。我將繼續探索這個工具,並進一步了解其功能和能力。
Rea Mendez - BAKAWAN Data Anallytics Inc.
課程 - OWASP Top 10 2025
機器翻譯
我非常喜歡學習關於AI攻擊的內容，以及那些可以開始實踐並積極用於安全測試的工具。我學到了很多之前不瞭解的知識，課程也達到了我的期望。培訓中我最喜歡的部分是Comet Browser，它的功能讓我感到驚歎。這絕對是我會進一步研究的內容。總體來說，這是一門很棒的課程，我很享受學習所有OWASP GenAI Top 10的內容。
Patrick Collins - Optum
課程 - OWASP GenAI Security
機器翻譯
