OWASP Web Hacking là khóa học được xây dựng dựa trên tài liệu Kali Web Penentration Testing Cookbook và danh sách các web bug thông dụng của OWASP. Tài liệu rất hay và trình bày dễ hiểu, đặc biệt là những video bài giảng được trình bày, hướng dẫn trên hệ thống máy ảo local lab step by step bám theo 100 % nội dung của chương trình, giúp học viên nhanh chóng và dễ dàng nắm bắt các kiến thức, rèn luyện kỹ năng để có thể học thêm những chương trình nâng cao như WAHS của EC Council hay các khóa học web hacking chuyên biệt khác.
- Hình thức học tập qua các video hướng dẫn online trên stream, có vlab cài đặt trên máy ảo, giáo trình pdf, và group hỗ trợ để tải tool và hướng dẫn cơ sở trên Telegram.
Học phí : 3.000.000 VND
Giảm giá 50 % cho học viên Cũ (còn 1500K) và 30 % cho học viên mới Mới (còn 2000K)
Gia hạn : Các thành viên hết hạn có thể renew 2 năm với phí 1000 K để update nội dung mới, vào nhóm Tele … Còn các nội dung cũ trên stream thì vẫn còn.
Thank toán và vào học ngay :
Thanh toán online qua Paypal , Credit Card :
Thanh toán 2000 K (đã giảm 20 %) qua chuyển khoản đến STK 999990914433338 , Chủ tài khoản Nguyen Thi Quynh Vien, HDBank.
Sau đây là nội dung khóa học, các bạn có thể click vào các đề mục để dẫn đến bài học nhưng cần login Stream để có quyền xem bài. Tài liệu hãy tải từ group hoặc 1-Drive. Hiệu lực tài khoản học tập là 24 tháng.
Lưu ý : Có thể có một số thay đổi trong phần giới thiệu, dẫn nhập nhưng nội dung chính vẫn bám theo 100 % mục lục. Click vào đề mục chính để đến khu vực bài học tương ứng…
Introduction
Updating and upgrading Kali Linux
Getting ready
How to do it…
How it works…
There’s more…
Installing and running OWASP Mantra
Getting ready
How to do it…
See also
Setting up the Iceweasel browser
How to do it…
How it works…
There’s more…
Installing VirtualBox
Getting ready
How to do it…
How it works…
There’s more…
See also
Creating a vulnerable virtual machine
How to do it…
How it works…
See also
Creating a client virtual machine
How to do it…
How it works…
See also
Configuring virtual machines for correct communication
Getting ready
How to do it…
How it works…
Getting to know web applications on a vulnerable VM
Getting ready
How to do it…
How it works…
2. Reconnaissance
Introduction
Scanning and identifying services with Nmap
Getting ready
How to do it…
How it works…
There’s more…
See also
Identifying a web application firewall
How to do it…
How it works…
Watching the source code
Getting ready
How to do it…
How it works…
Using Firebug to analyze and alter basic behavior
Getting ready
How to do it…
How it works…
There’s more…
Obtaining and modifying cookies
Getting ready
How to do it…
How it works…
Taking advantage of robots.txt
How to do it…
How it works…
Finding files and folders with DirBuster
Getting ready
How to do it…
How it works…
Password profiling with CeWL
How to do it…
How it works…
See also
Using John the Ripper to generate a dictionary
Getting ready
How to do it…
How it works…
There’s more…
Finding files and folders with ZAP
Getting ready
How to do it…
How it works…
See also
3. Crawlers and Spiders
Introduction
Downloading a page for offline analysis with Wget
Getting ready
How to do it…
How it works…
There’s more…
Downloading the page for offline analysis with HTTrack
Getting ready
How to do it…
How it works…
There’s more…
Using ZAP’s spider
Getting ready
How to do it…
How it works…
There’s more…
Using Burp Suite to crawl a website
Getting ready
How to do it…
How it works…
Repeating requests with Burp’s repeater
Getting ready
How to do it…
How it works…
Using WebScarab
Getting ready
How to do it…
How it works…
Identifying relevant files and directories from crawling results
How to do it…
How it works…
4. Finding Vulnerabilities
Introduction
Using Hackbar add-on to ease parameter probing
Getting ready
How to do it…
How it works…
Using Tamper Data add-on to intercept and modify requests
How to do it…
How it works…
Using ZAP to view and alter requests
Getting ready
How to do it…
How it works…
Using Burp Suite to view and alter requests
Getting ready
How to do it…
How it works…
Identifying cross-site scripting (XSS) vulnerabilities
How to do it…
How it works…
There’s more…
Identifying error based SQL injection
How to do it…
How it works…
There’s more…
Identifying a blind SQL Injection
How to do it…
How it works…
See also
Identifying vulnerabilities in cookies
How to do it
How it works…
There’s more…
Obtaining SSL and TLS information with SSLScan
How to do it…
How it works…
There’s more…
See also
Looking for file inclusions
How to do it…
How it works…
There’s more…
Identifying POODLE vulnerability
Getting ready
How to do it…
How it works…
See also
5. Automated Scanners
Introduction
Scanning with Nikto
How to do it…
How it works…
Finding vulnerabilities with Wapiti
How to do it…
How it works…
Using OWASP ZAP to scan for vulnerabilities
Getting ready
How to do it…
How it works…
There’s more…
Scanning with w3af
How to do it…
How it works…
There’s more…
Using Vega scanner
How to do it…
How it works…
Finding Web vulnerabilities with Metasploit’s Wmap
Getting ready
How to do it…
How it works…
6. Exploitation – Low Hanging Fruits
Introduction
Abusing file inclusions and uploads
Getting ready
How to do it…
How it works…
There’s more…
Exploiting OS Command Injections
How to do it…
How it works…
Exploiting an XML External Entity Injection
Getting ready
How to do it…
How it works…
There’s more…
See also
Brute-forcing passwords with THC-Hydra
Getting ready
How to do it…
How it works…
There’s more…
Dictionary attacks on login pages with Burp Suite
Getting ready
How to do it…
How it works…
There’s more…
Obtaining session cookies through XSS
Getting ready
How to do it…
How it works…
There’s more…
Step by step basic SQL Injection
How to do it…
How it works…
Finding and exploiting SQL Injections with SQLMap
How to do it…
How it works…
There’s more…
See also
Attacking Tomcat’s passwords with Metasploit
Getting ready
How to do it…
How it works…
See also
Using Tomcat Manager to execute code
How to do it…
How it works…
7. Advanced Exploitation
Introduction
Searching Exploit-DB for a web server’s vulnerabilities
How to do it…
How it works…
There’s more…
See also
Exploiting Heartbleed vulnerability
Getting ready
How to do it…
How it works…
Exploiting XSS with BeEF
Getting ready
How to do it…
How it works…
There’s more…
Exploiting a Blind SQLi
Getting ready
How to do it…
How it works…
There’s more…
Using SQLMap to get database information
How to do it…
How it works…
Performing a cross-site request forgery attack
Getting ready
How to do it…
Executing commands with Shellshock
How to do it…
How it works…
There’s more…
Cracking password hashes with John the Ripper by using a dictionary
How to do it…
How it works…
Cracking password hashes by brute force using oclHashcat/cudaHashcat
Getting ready
How to do it…
How it works…
8. Man in the Middle Attacks
Introduction
Setting up a spoofing attack with Ettercap
Getting ready
How to do it…
How it works…
Being the MITM and capturing traffic with Wireshark
Getting ready
How to do it…
How it works…
See also
Modifying data between the server and the client
Getting ready
How to do it…
How it works…
There’s more…
See also
Setting up an SSL MITM attack
How to do it…
How it works…
See also
Obtaining SSL data with SSLsplit
Getting ready
How to do it…
How it works…
Performing DNS spoofing and redirecting traffic
Getting ready
How to do it…
How it works…
See also
9. Client-Side Attacks and Social Engineering
Introduction
Creating a password harvester with SET
How to do it…
How it works…
Using previously saved pages to create a phishing site
Getting ready
How to do it…
How it works…
Creating a reverse shell with Metasploit and capturing its connections
How to do it…
How it works…
Using Metasploit’s browser_autpwn2 to attack a client
How to do it…
How it works…
Attacking with BeEF
Getting ready
How to do it…
How it works…
Tricking the user to go to our fake site
How to do it…
How it works…
There’s more…
See also
10. Mitigation of OWASP Top 10
Introduction
A1 – Preventing injection attacks
How to do it…
How it works…
See also
A2 – Building proper authentication and session management
How to do it…
How it works…
See also
A3 – Preventing cross-site scripting
How to do it…
How it works…
See also
A4 – Preventing Insecure Direct Object References
How to do it…
How it works…
A5 – Basic security configuration guide
How to do it…
How it works…
A6 – Protecting sensitive data
How to do it…
How it works…
A7 – Ensuring function level access control
How to do it…
How it works…
A8 – Preventing CSRF
How to do it…
How it works…
See also
A9 – Where to look for known vulnerabilities on third-party components
How to do it…
How it works…
A10 – Redirect validation
How to do it…
How it works…
Để học và thực hành các bạn chỉ cần cài các chương trình quản lý máy ảo như Vmware và download vlab gồm Kali 2022, OwaspBwa, BeeBug, Kioptrix L1,2,3 và một vài VulnHub hay về Web để thực hành thêm trên group học tập.
Đào Tạo CEH - CHFI - ECSA - CPENT - LPT - PENTEST+ CySA+ SECURITY + 