<?xml version="1.0" standalone="no" ?>

<!--  AIT__Testing_Web_App_Security.xml	Course Outline in XML format
 *
 * Copyright 2011 Affinity IT Training, LLC. All Rights Reserved.
 *
 -->

<!DOCTYPE FAI:CourseOutline SYSTEM "FAI_CourseOutline.dtd">

<?xml-stylesheet type="text/xsl" href="FAI_CourseOutline.xsl" ?>	

<FAI:CourseOutline FAI:link="AIT_Testing_Web_App_Security.xml"
     xmlns:FAI="http://www.fisher-assoc.com/DTDs/FAI_CourseOutline.dtd" >

  <FAI:CourseTitle FAI:level="Intermediate"  FAI:code="AIT_TST_WEB_APPS">
    Testing Web Application Security
  </FAI:CourseTitle>  

  <FAI:CourseCategory>CyberSec</FAI:CourseCategory>
  <FAI:CourseCategory>Development</FAI:CourseCategory>
  <FAI:CourseCategory>Testing</FAI:CourseCategory>
  <FAI:CourseCategory>Quality</FAI:CourseCategory>
  <FAI:CourseCategory>Web</FAI:CourseCategory>

  <FAI:SummaryInfo>

    <FAI:CourseDesc FAI:version="X.X" >
	This course 
	describes how to meet the 
	challenges of security testing  
	Web Applications.  
	It describes common vulnerabilities 
	and provides a methodology for 
	planning and conducting security testing.
    </FAI:CourseDesc>

    <FAI:CourseDuration>
	2 Days
    </FAI:CourseDuration>

    <FAI:CourseAudience>
    	Software developers, Testers, Business Analysts,
    	Project Managers, and Security staff
    	seeking to gain a practical insights
    	into how to assess the robustness of web applications.
    </FAI:CourseAudience>

    <FAI:CourseObjectives>
      <FAI:Objective FAI:desc="Understand the distinction between testing Security Requirements and security testing" />
      <FAI:Objective FAI:desc="Recognize the opportunities to make security a priority in the SDLC" />
      <FAI:Objective FAI:desc="Be prepared to plan and execute a rigorous security test plan" />
      <FAI:Objective FAI:desc="Be familiar with techniques used to assess and bypass input validation" />
      <FAI:Objective FAI:desc="Be familiar with techniques used to attack Authentication and Access Control" />
      <FAI:Objective FAI:desc="Be familiar with techniques used to attack data confidentiality" />
      <FAI:Objective FAI:desc="Be familiar with techniques used to assess vulnerability to Denial of Service (DoS) attacks" />
      <FAI:Objective FAI:desc="Be prepared to recognize exploitable Web Server and Database vulnerabilities" />
    </FAI:CourseObjectives>

    <FAI:CourseSetupList>
    </FAI:CourseSetupList>    

    <FAI:CourseTextList>

      <FAI:Text  FAI:title="Course Workbook" />

    </FAI:CourseTextList>    

    <FAI:CoursePrerequisiteList>
	<FAI:CoursePrerequisite FAI:title="Fundamentals of Software Quality Assurance (or equivalent)" FAI:link="AIT_SW_Quality.xml" /> 
	<FAI:CoursePrerequisite FAI:title="A working understanding of HTTP and familarity with Web Application design." />
    </FAI:CoursePrerequisiteList>    

  </FAI:SummaryInfo>  

  <FAI:TopicList>

    <FAI:SuperTopic FAI:title="Introduction" >
      <FAI:Topic FAI:title="Welcome" />
      <FAI:Topic FAI:title="Motivation: The Security Crisis" />
      <FAI:Topic FAI:title="Course Objectives" />
      <FAI:Topic FAI:title="Technical Setup" />
      <FAI:Topic FAI:title="Course Overview" />
      <FAI:Topic FAI:title="The Software Development Lifecycle" />
      <FAI:Topic FAI:title="The Holistic Approach to Software Security" />
      <FAI:Topic FAI:title="The ROI of Application Security" />
      <FAI:Topic FAI:title="Lab Exercise: Finding Motivation" />
      <FAI:Topic FAI:title="Quiz" />
    </FAI:SuperTopic>

    <FAI:SuperTopic FAI:title="Security Test Planning" >
      <FAI:Topic FAI:title="Software Quality vs. Security Testing" />
      <FAI:Topic FAI:title="Security Testing vs. Design/Code Reviews" />
      <FAI:Topic FAI:title="White Box and Black Box Testing" />
      <FAI:Topic FAI:title="Positive and Negative Testing" />
      <FAI:Topic FAI:title="Control Flow Testing" />
      <FAI:Topic FAI:title="Data Flow Testing" />
      <FAI:Topic FAI:title="Domain Testing" />
      <FAI:Topic FAI:title="Testing Use-Cases" />
      <FAI:Topic FAI:title="Testing Business Processes" />
      <FAI:Topic FAI:title="Test Planning" />
      <FAI:Topic FAI:title="Test Execution" />
      <FAI:Topic FAI:title="Test Results" />
      <FAI:Topic FAI:title="Security Test Case Strategy" />
      <FAI:Topic FAI:title="Testing Security Requirements" />
      <FAI:Topic FAI:title="Testing Data Domains" />
      <FAI:Topic FAI:title="Testing Infrastructure" />
      <FAI:Topic FAI:title="Testing Architecture" />
      <FAI:Topic FAI:title="Testing Application Design" />
      <FAI:Topic FAI:title="Automated Testing Tools" />
      <FAI:Topic FAI:title="Lab Exercise: Define Test Cases" />
      <FAI:Topic FAI:title="Quiz" />
    </FAI:SuperTopic>

    <FAI:SuperTopic FAI:title="Malformed Input" >
      <FAI:Topic FAI:title="What is: SQL Injection" />
      <FAI:Topic FAI:title="What is: Command Injection" />
      <FAI:Topic FAI:title="What is: A Path Traversal Exploit" />
      <FAI:Topic FAI:title="What is: A Format String Exploit" />
      <FAI:Topic FAI:title="Analyzing Input Validation" />
      <FAI:Topic FAI:title="Unexpected Input" />
      <FAI:Topic FAI:title="Exceeding Limits" />
      <FAI:Topic FAI:title="Numerics" />
      <FAI:Topic FAI:title="Encoding Technologies" />
      <FAI:Topic FAI:title="Bypassing Filters" />
      <FAI:Topic FAI:title="Exploiting Path Traversal" />
      <FAI:Topic FAI:title="Cool Tools: A Web Proxy " />
      <FAI:Topic FAI:title="Lab Exercise: Input Validation" />
      <FAI:Topic FAI:title="Quiz" />
    </FAI:SuperTopic>

    <FAI:SuperTopic FAI:title="Breaking Authentication" >
      <FAI:Topic FAI:title="Violating Assumptions" />
      <FAI:Topic FAI:title="Password Cracking" />
      <FAI:Topic FAI:title="Avoiding Vulnerability: Parameter Driven Behavior" />
      <FAI:Topic FAI:title="Avoiding Vulnerability: Sequence Driven Behavior" />
      <FAI:Topic FAI:title="Lab Exercise: Who Are You ?" />
      <FAI:Topic FAI:title="Quiz" />
    </FAI:SuperTopic>

    <FAI:SuperTopic FAI:title="Escalating Privilege" >
      <FAI:Topic FAI:title="Roles and Permissions" />
      <FAI:Topic FAI:title="Representing Roles and Permissions" />
      <FAI:Topic FAI:title="Escalating Privilege" />
      <FAI:Topic FAI:title="Lab Exercise: Movin&apos; on Up" />
      <FAI:Topic FAI:title="Quiz" />
    </FAI:SuperTopic>

    <FAI:SuperTopic FAI:title="Session Hijinks" >
      <FAI:Topic FAI:title="Token Weaknesses" />
      <FAI:Topic FAI:title="Cookie Vulnerabilities" />
      <FAI:Topic FAI:title="Session and Cookie Lifetime" />
      <FAI:Topic FAI:title="Lab Exercise: In Session" />
      <FAI:Topic FAI:title="Quiz" />
    </FAI:SuperTopic>

    <FAI:SuperTopic FAI:title="Denial of Service" >
      <FAI:Topic FAI:title="Application Vulernabilities" />
      <FAI:Topic FAI:title="Web Server Vulnerabilities" />
      <FAI:Topic FAI:title="Database Vulnerabilities" />
      <FAI:Topic FAI:title="Lab Exercise: Plausible Deniability" />
      <FAI:Topic FAI:title="Quiz" />
    </FAI:SuperTopic>

    <FAI:SuperTopic FAI:title="Confidentiality" >
      <FAI:Topic FAI:title="Encryption Vulnerabilities" />
      <FAI:Topic FAI:title="Mishandling Sensitive Information" />
      <FAI:Topic FAI:title="Lab Exercise: Confident ?" />
      <FAI:Topic FAI:title="Quiz" />
    </FAI:SuperTopic>

    <FAI:SuperTopic FAI:title="Cross-Site Scripting" >
      <FAI:Topic FAI:title="Spotting CSS Vulnerabilities" />
      <FAI:Topic FAI:title="Lab Exercise: Promiscuous URLs" />
      <FAI:Topic FAI:title="Quiz" />
    </FAI:SuperTopic>

    <FAI:SuperTopic FAI:title="Exploiting Application Logic" >
      <FAI:Topic FAI:title="Analyzing Dependencies and Assumptions" />
      <FAI:Topic FAI:title="Exploiting Trust Relationships" />
      <FAI:Topic FAI:title="Lab Exercise: Dependencies and Assumptions" />
      <FAI:Topic FAI:title="Quiz" />
    </FAI:SuperTopic>

    <FAI:SuperTopic FAI:title="Platform Vulnerabilities" >
      <FAI:Topic FAI:title="Web Server Attack Vectors" />
      <FAI:Topic FAI:title="Database Attack Vectors" />
      <FAI:Topic FAI:title="OS Attack Vectors" />
      <FAI:Topic FAI:title="Exploiting Trust Relationships" />
      <FAI:Topic FAI:title="Lab Exercise: How Do You Like Me Now ?" />
      <FAI:Topic FAI:title="Quiz" />
    </FAI:SuperTopic>

    <FAI:SuperTopic FAI:title="Miscellaneous Mayhem" >
      <FAI:Topic FAI:title="Caching Sensitive Data" />
      <FAI:Topic FAI:title="Error Reporting" />
      <FAI:Topic FAI:title="Logging" />
      <FAI:Topic FAI:title="Interfacing With Other Systems" />     
      <FAI:Topic FAI:title="Information Resources" />     
      <FAI:Topic FAI:title="Lab Exercise: Misc Mayhem" />
      <FAI:Topic FAI:title="Quiz" />
    </FAI:SuperTopic>

  </FAI:TopicList>

  <FAI:Appendix FAI:title="Regular Expressions" />
  <FAI:Appendix FAI:title="Encoding Formats and Tools" />
  <FAI:Appendix FAI:title="HTTP Overview" />
  <FAI:Appendix FAI:title="Quiz Answers" />
  <FAI:Appendix FAI:title="Lab Solutions" />
   
</FAI:CourseOutline>

