WEB Application security – Divasprik Academy

Learn how to hack web applications, automate your exploits in python and defend web applications against real world attacks!

Learn how to hack web applications, automate your exploits in python and defend web applications against real world attacks! For each vulnerability type, we dive into the technical details and then gain hands-on experience by solving labs that model real-world vulnerabilities.

Download Prospects

Download Certification

Learn how to hack web applications, automate your exploits in python and defend web applications against real world attacks!

Learn how to hack web applications, automate your exploits in python and defend web applications against real world attacks! For each vulnerability type, we dive into the technical details and then gain hands-on experience by solving labs that model real-world vulnerabilities.

SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
SQL injection vulnerability allowing login bypass
SQLi UNION attack determining the number of columns returned by the query
SQL injection UNION attack, finding a column containing text
SQL injection UNION attack, retrieving data from other tables
SQL injection UNION attack, retrieving multiple values in a single column
SQL injection attack, querying the database type and version on Oracle
SQLi attack, querying the database type and version on MySQL & Microsoft
SQL injection attack, listing the database contents on non Oracle databases

SQL injection attack, listing the database contents on Oracle
Blind SQL injection with conditional responses
Blind SQL injection with conditional errors
Blind SQL injection with time delays
Blind SQL injection with time delays and information retrieval
Blind SQL injection with out-of-band interaction
Blind SQL injection with out of band data exfiltration
SQL injection with filter bypass via XML encoding
Visible error-based SQL injection

Username enumeration via different responses
2FA simple bypass
Password reset broken logic
Username enumeration via subtly different responses
Username enumeration via response timing
Broken brute-force protection, IP block
Username enumeration via account lock

2FA broken logic
Brute-forcing a stay-logged-in cookie
Offline password cracking
Password reset poisoning via middleware
Password brute-force via password change
Broken brute-force protection, multiple credentials per request
2FA bypass using a brute-force attack

OS command injection, simple case
Blind OS command injection with time delays
Blind OS command injection with output redirection
Blind OS command injection with out-of-band interaction
Blind OS command injection with out-of-band data exfiltration

Excessive trust in client-side controls
High-level logic vulnerability
Inconsistent security controls
Flawed enforcement of business rules
Low-level logic flaw
Inconsistent handling of exceptional input

Information disclosure in error messages
Information disclosure on debug page
Source code disclosure via backup files
Authentication bypass via information disclosure
Information disclosure in version control history

Unprotected admin functionality
Unprotected admin functionality with unpredictable URL
User role controlled by request parameter
User role can be modified in user profile
URL-based access control can be circumvented
Method-based access control can be circumvented
User ID controlled by request parameter

User ID controlled by request parameter, with unpredictable user IDs
User ID controlled by request parameter with data leakage in redirect
User ID controlled by request parameter with password disclosure
Insecure direct object references
Multi-step process with no access control on one step
Referer-based access control

Remote code execution via web shell upload
Web shell upload via Content-Type restriction bypass
Web shell upload via path traversal
Web shell upload via extension blacklist bypass
Web shell upload via obfuscated file extension
Remote code execution via polyglot web shell upload
Web shell upload via race condition

Basic SSRF against the local server
Basic SSRF against another back-end system
SSRF with blacklist-based input filter
SSRF with whitelist-based input filter
SSRF with filter bypass via open redirection vulnerability
Blind SSRF with out-of-band detection
Blind SSRF with Shellshock exploitation

Exploiting XXE using external entities to retrieve files
Exploiting XXE to perform SSRF attacks
Blind XXE with out-of-band interaction
Blind XXE with out-of-band interaction via XML parameter entities
Exploiting blind XXE to exfiltrate data using a malicious external DTD
Exploiting blind XXE to retrieve data via error messages
Exploiting XInclude to retrieve files
Exploiting XXE via image file upload
Exploiting XXE to retrieve data by repurposing a local DTD

Reflected XSS into HTML context with nothing encoded
Stored XSS into HTML context with nothing encoded
DOM XSS in document.write sink using source location.search
DOM XSS in innerHTML sink using source location.search
DOM XSS in jQuery anchor href attribute sink using location.search source
DOM XSS in jQuery selector sink using a hashchange event
Reflected XSS into attribute with angle brackets HTML-encoded
Stored XSS into anchor href attribute with double quotes HTML-encoded
Reflected XSS into a JavaScript string with angle brackets HTML encoded
DOM XSS in document.write sink using source location.search inside a select element
DOM XSS in AngularJS expression with angle brackets and double quotes HTML-encoded
Reflected DOM XSS

Stored DOM XSS
Exploiting cross-site scripting to steal cookies
Exploiting cross-site scripting to capture passwords
Exploiting XSS to perform CSRF
Reflected XSS into HTML context with most tags and attributes blocked
Reflected XSS into HTML context with all tags blocked except custom ones
Reflected XSS with some SVG markup allowed
Reflected XSS in canonical link tag
Reflected XSS into a JavaScript string with single quote and backslash escaped
Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped
Reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded and single quotes escaped
Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped
Reflected XSS into a template literal with angle brackets, single, double quotes, backslash and backticks Unicode-escaped

CSRF vulnerability with no defenses
CSRF where token validation depends on request method
CSRF where token validation depends on token being present
CSRF where token is not tied to user session
CSRF where token is tied to non-session cookie
CSRF where token is duplicated in cookie
CSRF where Referer validation depends on header being present
CSRF with broken Referer validation
SameSite Lax bypass via method override
SameSite Strict bypass via client-side redirect
SameSite Strict bypass via sibling domain
SameSite Lax bypass via cookie refresh

Basic clickjacking with CSRF token protection
Clickjacking with form input data prefilled from a URL parameter
Clickjacking with a frame buster script
Exploiting clickjacking vulnerability to trigger DOM-based XSS
Multistep clickjacking

Career Opportunities

Cyber Security can open up a wide range of career opportunities in a rapidly evolving and high-demand field.

EMAIL

CALL NOW

Career Opportunities

Quick Links

COURSES

CONTACT US