Ruxcon Training



Marcus Pinto

October 19 - 20, Melbourne, Australia



ENDS July 31



ENDS August 31



STARTS September 01

Prices do not include GST


MDSec’s Web Application Hacker’s Handbook Series (WAHH) has sold over 20,000 copies. As a training course, this has been delivered to over 30% of the CREST member companies, covering all of the vulnerabilities and technologies in the WAHH, under the guidance of the book’s authors.

The course syllabus follows the chapters of the Second Edition of The Web Application Hacker's Handbook, with strong focus on practical attacks and methods. After a short introduction to the subject we delve into common insecurities in logical order:

  • Introduction to Web Application Security Assessment (Chapters 1-3)
  • Automating Bespoke Attacks: Practical hands-on experience with Burp Suite (Chapter 13)
  • Application mapping and bypassing client-side controls (Chapters 4-5)
  • Failures in Core Defense Mechanisms: Authentication, Session Management, Access Control, Input Validation (Chapters 6-8)
  • Injection and API flaws: (Chapters 9-10)
  • User-to-User Attacks (Chapters 12-13)

Attendees will gain practical experience of:

  • Real-world, 2017 techniques in blind XXE injection, Java Deserialization, request method abuse, relative path overwrites, XSS filter evasion
  • How to hack using all of the "OWASP top 10"...from SQLi to LDAP, XPath, SOAP, HTTP Parameter Pollution (HPP), and HPI
  • How to quickly and efficiently pinpoint and exploit vulnerabilities in web applications
  • The real risk: how to turn XSS/CSRF vulnerabilities into full account compromise
  • Harnessing new technologies such as HTML5, NoSQL, and Ajax
  • New attack types and techniques: Bit Flipping, Padding Oracle, Automated Access Control checking
  • How to immediately recognize and exploit Logic Flaws

For more detailed information about the course's practical structure, see the Web Application Hacker's Methodology chapter from the original version of the book.