OWASP Web Security Testing Training in Thimphu, Bhutan

This course provides in-depth knowledge and hands-on practice in web application penetration testing using the OWASP Web Security Testing Guide (WSTG) and OWASP Top 10 standards. Participants will learn to identify, exploit, and mitigate common web vulnerabilities, conduct secure code reviews, and perform both manual and automated testing of modern web applications. The course emphasizes real-world scenarios to prepare participants for professional security assessments and compliance requirements.

Foundations & Testing Methodology

1. Introduction to Web Application Security

   • Web threat landscape

   • OWASP Top 10 & WSTG overview

   • Attack surface of web applications

2. Testing Infrastructure and Setup

   • Lab setup with vulnerable apps (DVWA, Juice Shop, WebGoat)

   • Tools: Burp Suite, ZAP, SQLMap, wfuzz

   • Setting up intercepting proxies

3. Information Gathering & Reconnaissance

   • Fingerprinting technologies & frameworks

   • Directory/file enumeration

   • Identifying hidden parameters and endpoints

4. Testing Authentication & Session Management

   • Weak login implementations

   • Session fixation, session hijacking

   • Multi-factor authentication testing

OWASP Top 10 Vulnerability Testing

1. Injection Flaws

   • SQL Injection, Command Injection, LDAP Injection

   • Tools and exploitation techniques

2. Cross-Site Scripting (XSS)

   • Reflected, stored, and DOM-based XSS

   • Payload crafting & bypass techniques

3. Broken Access Control

   • IDORs (Insecure Direct Object References)

   • Privilege escalation testing

4. Cross-Site Request Forgery (CSRF)

   • Exploitation of trust in authenticated users

   • Mitigation strategies

5. Security Misconfigurations

   • Common server and framework misconfigurations

   • Automated scanning with Nikto and Nmap

Advanced Testing & Reporting

1. Testing Cryptography & Data Security

   • Insecure data storage

   • Weak TLS/SSL configurations

   • Improper cryptographic usage

2. Testing APIs & Modern Web Apps

   • REST & GraphQL API testing

   • JWT and token-based authentication flaws

   • Case study: API misconfiguration

3. Testing Business Logic Flaws

   • Logical bypass attacks

   • Abuse of workflows (e.g., coupon reuse, price manipulation)

4. Reporting & Remediation

   • Writing professional penetration testing reports

   • Mapping findings to OWASP WSTG & Top 10

   • Best practices for remediation

Hands-on Exercises

Summary and Conclusion