EC-Council Web Application Hacking and Security (WAHS)
Description
Web Application Hacking and Security has challenges derived from the iLab environments of EC Council – from Certified Ethical Hacker (C|EH) to the Certified
Penetration Testing Professional (C|PENT); from Certified Application Security Engineer (C|ASE) .Net to Java. But Web Application Hacking and Security goes
beyond this to more difficult scenarios as you advance through each problem. Web Application Hacking and Security is like Capture-The-Flag (CTF) competitions meant to test your hacking skills. But you can keep on trying until you achieve the goal. Test your skills and work alone to solve complex problems or follow the instructor as he does walkthroughs to help you learn Web Application Hacking and Security
Target group
- Pentesters / Red Teamers
- Auditeurs de sécurité Web
- Développeurs Web sensibilisés à la sécurité
- Analystes vulnérabilités / SOC
- Responsables sécurité d’applications
- Étudiants ou professionnels préparant CEH, CPENT ou CASE
Program
- Duration : 5 days
Modules & techniques abordés :
- Pentest Web avancé
- Injection SQL (SQLi) – avancée
- XSS (Reflected, Stored, DOM)
- CSRF (GET & POST)
- SSRF (Server Side Request Forgery)
- Insecure Direct Object Reference (IDOR)
- Misconfigurations serveur
- Directory Brute Forcing
- Arbitrary File Upload / Download
- Remote / Local File Inclusion (RFI / LFI)
- Command Injection / Remote Code Execution
- Auth Bypass, Broken Access Control
- Session Fixation, Cookie Forgery, Clickjacking
- HTTP Header Modification, Log Poisoning
- CMS Vulnerability Scanning (WordPress, Joomla…)
Goal
- Tests d’intrusion web avancés (white-box & black-box).
- Exploitation de failles OWASP Top 10 : XSS, SQLi, CSRF, SSRF, IDOR, RFI/LFI.
- Analyse de sécurité des CMS, composants tiers et configurations serveur.
- Détection et exploitation de failles logiques complexes (auth bypass, privilege escalation).
- Manipulation de cookies, entêtes HTTP, sessions, et canaux non sécurisés.
- Utilisation d’outils et scripts de scanning, fuzzing et injection.
Recommended
- Connaissances de base en HTTP, HTML, JS, SQL
- Connaissance des environnements Linux et virtualisation
- Utilisation d’un proxy (Burp Suite)
- Expérience en script (Python, Bash, PHP…) recommandée
- Langue : Anglais
- Organisme de certification : EC-Council
- Certification : Oui
- Accesibilité : Oui
- Durée : 5 Jours
Information importante :
Nos formations ne sont pas inscrites au Répertoire National des Certifications Professionnelles (RNCP), mais elles sont conformes aux exigences du Répertoire Spécifique (RS).