Web Application Security Testing: Encoding, Filtering & Evasion Basics

Description

In the ever evolving world of cybersecurity, web applications continue to be prime targets for cyberattacks. To effectively attack and defend against these threats and vulnerabilities, you need to go beyond the basics of standard web application penetration testing.

This course is designed to take your web app penetration testing expertise to the next level by focusing on three essential aspects of web application security testing that frequently get overlooked: encoding, filtering, and evasion. In order to understand how to analyze and assess a web applications for vulnerabilities, you need to understand how web application developers implement encoding, input filtering and security mechanisms like WAFs (Web Application Firewalls) for improved security.

This course will start off by introducing you to the practice of characterset encoding, URL encoding, HTML encoding and Base64 encoding and will explain how and why these encoding techniques are utilized in web applications. You will then be introduced to the process of server-side and client-side input filtering, where you will get a tacit understanding of the different types of input filtering techniques used to prevent vulnerabilities like XSS, SQL Injection and command injection. The course will then outline how these filtering techniques can be bypassed through manual and automated techniques. Finally, this course will introduce you to WAFs (Web Application Firewalls), Proxies and server-side IDSs (Intrusion Detection Systems). You will learn about how they work, how they can be identified and how they can be bypassed.