Hacking Extreme Web Applications

“Hacking Extreme Web Applications” discusses attacks on web applications and back-end systems.

The intensive course teaches you about the methods used by attackers as well as both well-known and lesser-known techniques for attacking web applications and the databases and back ends located behind them.

In several laboratory exercises, you will get to put into practice what you have learned. For this purpose, each participant will be provided with numerous tools and exploits, which go far beyond the usual scanners. In addition to several aha moments, this also allows participants to evaluate and assess security-relevant questions.

The trainers carry out security audits on a regular basis, and they are known as experts in the application security field.

The training covers all OWASP Top Ten vulnerability types.

Main topics:

Information gathering

• Traditional information gathering by banners, error pages, etc.
• Webserver fingerprinting
• Using crawlers
• Identifying metadata information

Attacks on web and application servers

• Software vulnerabilities in web and application servers (buffer overflows, etc.)
• Exploiting misconfigurations (directory listings, etc.)
• Application framework vulnerabilities

Attacks on the transmission

• Eavesdropping on the communication, SSL-man-in-the-middle attacks
• TLS vulnerabilities and misconfigurations
• Vulnerabilities in application level encryption

Attacks on the application

• Attacks on the authentication process
• Attacks on stored passwords
• Bypassing CAPTCHAs
• Attacks on the session management
• Cross-site scripting (persistent, non-persistent, DOM-based)
• Cross-site request forgery (CSRF), vulnerabilities in anti-CSRF mechanisms
• Server-Site Request Forgery (SSRF)
• Vulnerabilities in function level access control
• Vulnerabilities in object level access control
• File inclusion (local / remote)
• Open redirects
• Command injection
• Attacks using serialized objects
• File upload vulnerabilities
• Application logic vulnerabilities
• Vulnerabilities in client-side JavaScript logic
• Attacks on AJAX services
• HTML5-based attack vectors
• Web spoofing
• CORS (cross-origin resource sharing)
• Attacks based on third-party resources integrated in the application
• Logging of security-relevant events to track attacks
• Attacks facilitated by an insecure architecture

Attacks on the back end

• SQL injection / blind SQL injection
• LDAP injection
• Vulnerabilities in web services
• XML injection / XML-External-Entity-attacks (XXE) / XML bombs
• XPath injection
• XSLT injection

Systems covered:
Unix-based or Windows-based web servers, databases, application servers, etc.

Target group:
Administrators and security managers who are not afraid to see security through the attacker’s eyes, diving deeply into his world. The training is also interesting for developers and administrators of web servers and e-business systems. 

This course must definitely be considered an “advanced” training. The number of participants is limited to make sure the instruction is individual and effective.

Requiremenst:
Basic knowledge of HTTP, HTML and in the web server and database field. The exercises partly require using command-line tools on Linux. The trainers will be happy to assist in managing them in case help is needed.

Price:
€ 2,400 

This training will be held in German. Our trainers work as consultants and penetration testers and can therefore complement the course with comprehensive and recent practical experience.

You will receive CPE Points for participating in the Hacking Extreme Web Applications training. The training takes 24 hours. You will get a certificate after having completed the training.

Dates: 
June 24-26, 2025 in Ludwigsburg
November 25-27, 2025 in Ludwigsburg

Place:
The training course will take place in a fine, selected hotel:

• Ludwigsburg: nestor Hotel Ludwigsburg

We will gladly reserve a room for you at a special rate in the respective hotel.

We also gladly offer you the course as an in-house training.

Online registration