WEB-200 Foundational Web Application Assessments with Kali Linux by OffSec introduces web application security testing methodology, tools, and techniques in a hands-on, self-paced environment. Learners gain a deep understanding of common web vulnerabilities and how to exploit them responsibly. Completing the course and passing the exam earns the OffSec Web Assessor (OSWA) certification, demonstrating the ability to identify and exploit vulnerabilities in web applications. The course covers tools for web assessors, providing experience with industry-standard tools like Burp Suite, OWASP ZAP, and sqlmap for identifying vulnerabilities and assessing web application security. Topics include Cross-Site Scripting (XSS) introduction, discovery, exploitation, and case studies. Learn how attackers inject malicious code into web pages to hijack user sessions, steal sensitive data, or deface websites. Discover how to identify and exploit XSS vulnerabilities and understand the different types of XSS attacks. Explore real-world case studies to strengthen defenses. Uncover how attackers trick authenticated users into performing unintended actions on web applications through Cross-Site Request Forgery (CSRF). Learn to identify and exploit CSRF vulnerabilities and explore practical mitigation techniques to protect against these attacks. Understand the impact of CSRF on user trust and data integrity. Exploiting CORS Misconfigurations. Learn the security risks of Cross-Origin Resource Sharing (CORS) misconfigurations and how attackers exploit these vulnerabilities to bypass access controls and access sensitive data. Understand how to identify and fix CORS misconfigurations for secure cross-origin communication. Database Enumeration. Master techniques to gather sensitive information about a web application’s database structure and content. Learn how attackers use this information for targeted attacks and explore methods to implement countermeasures. SQL Injection (SQLi). Learn how to exploit vulnerabilities in web applications that interact with databases, potentially leading to data compromise or unauthorized access. Understand the different types of SQL Injection attacks and their impact on security. Explore techniques for preventing and mitigating SQL Injection vulnerabilities. Learn to identify and exploit directory traversal vulnerabilities, and understand how to prevent unauthorized access to restricted areas of a web server. XML External Entity (XXE) Processing. Explore how attackers manipulate XML processors to access files, execute commands, or perform denial-of-service attacks. Understand the mechanics of XXE attacks and the potential consequences. Learn to secure XML parsers and prevent XXE vulnerabilities in web applications. Understand how attackers inject code into web application templates, potentially leading to remote code execution, information disclosure, or privilege escalation. Learn how to identify and exploit SSTI vulnerabilities and explore mitigation techniques to protect web applications. Learn how attackers force a web application to make requests to internal or external systems, leading to data exfiltration, service disruption, or access to internal resources. Understand various SSRF attack vectors and implement countermeasures to prevent unauthorized requests.
