These are the slides to my 2-day “Web Application Security Training Workshop”. The workshop is intended for all IT staff involved in web application development, e.g. software engineers, system analysts, quality engineers or application administrators.
The goals of the workshop are:
- Build security awareness for web applications
- Get to know attack methods of hackers
- Learn ways to discover security vulnerabilities
- Learn the basics of secure web development
Day one starts with a motivation of the topic and then covers the most severe vulnerabilities of web applications based on the OWASP Top 10 list. The attacks on those vulnerabilities are discussed and can be tried out in several examples.
Day two starts with a two hour hacking contest where each participant attacks the locally installed BodgeIt store and tries to get as many points on the score card as possible. Next the Secure Software Development Lifecycle is briefly discussed in order to prevent security flaws as early as possible.
/!\ Performing attacks on any website or server you do not own yourself is a crime in most countries!