[Pluralsight.com] Ethical Hacking: Hacking Web Applications [2015, ENG]

Understanding Security in Web Applications
Overview
The State of Web Application Security
Understanding Web Application Security
Query Strings, Routing, and HTTP Verbs
The Discoverability of Client Security Constructs
Protections Offered by Browsers
What the Browser Can't Defend Against
What's Not Covered in This Course
Summary

Reconnaissance and Footprinting
Overview
Spidering with NetSparker
Forced Browsing with Burp Suite
Directory Traversal
Banner Grabbing with Wget
Server Fingerprinting with Nmap
Discovery of Development Artefacts with Acunetix
Discovery of Services via Generated Documentation
Discovering Framework Risks
Identifying Vulnerable Targets with Shodan
Summary

Tampering of Untrusted Data
Overview
OWASP and the Top 10 Web Application Security Risks
Understanding Untrusted Data
Parameter Tampering
Hidden Field Tampering
Mass Assignment Attacks
Cookie Poisoning
Insecure Direct Object References
Defending Against Tampering
Summary

Attacks Involving the Client
Overview
Reflected Cross Site Scripting (XSS)
Persistent Cross Site Scripting (XSS)
Defending Against XSS Attacks
Identifying XSS Risks and Evading Filters
Client Only Validation
Insufficient Transport Layer Security
Cross Site Request Forgery (CSRF)
Summary

Attacks Against Identity Management and Access Controls
Overview
Understanding Weaknesses in Identity Management
Identity Enumeration
Weaknesses in the 'Remember Me' Feature
Resources Missing Access Controls
Insufficient Access Controls
Privilege Elevation
Summary

Denial of Service Attacks
Overview
Understanding DoS
Exploiting Password Resets
Exploiting Account Lockouts
Distributed Denial of Service (DDoS)
Automating DDoS Attacks with LOIC
DDoS as a Service
Features at Risk of a DDoS Attack
Other DDoS Attacks and Mitigations
Summary

Other Attacks on the Server
Overview
Improper Error Handling
Understanding Salted Hashes
Insecure Cryptographic Storage
Unvalidated Redirects and Forwards
Exposed Exceptions Logs with ELMAH
Vulnerabilities in Web Services
Summary