Go beyond the OWASP Top 10. This three-day advanced course covers OAuth 2.0/OIDC security, JWT attacks, advanced injection (NoSQL, LDAP, SSTI), race conditions, deserialization, SSRF, XXE, prototype pollution, HTTP smuggling and advanced cryptographic operations. Every attack is exploited and then fixed.
Advanced topics that go well beyond the OWASP Top 10. Each module starts with exploitation and ends with implementation of the defense. (Times are approximate.)
Go beyond the basics of OAuth 2.0 and OpenID Connect. Cover authorization code flow with PKCE, the risks of implicit flow, token binding, redirect URI validation, and the common misconfigurations that lead to account takeover. Implement a secure OAuth integration and test it against known attack patterns.
JWTs are everywhere and frequently misimplemented. Exploit algorithm confusion (none, HS256 vs RS256), missing claim validation (iss, aud, exp, nbf), JWK injection, and key confusion attacks. Then build a JWT validation library that handles all of these correctly.
SQL injection is just the start. Exploit NoSQL injection against MongoDB, LDAP injection against Active Directory, XPath injection against XML data stores, and Server-Side Template Injection against Jinja2, Twig and Freemarker. Understand the common pattern and how parameterized approaches apply across all injection classes.
Time-of-check to time-of-use flaws are among the hardest bugs to find and exploit. Reproduce race conditions in payment processing, coupon redemption and file operations. Implement locking, atomic operations, and idempotency keys as defenses.
Business logic flaws cannot be found by scanners. Walk through real-world examples: negative quantity purchases, workflow bypass, state machine violations, and privilege escalation through legitimate functionality. Learn the methodology for identifying these flaws through specification review and state analysis.
Exploit unsafe deserialization in Java (ObjectInputStream), Python (pickle), PHP (unserialize) and .NET (BinaryFormatter). Achieve remote code execution through gadget chains. Implement the defenses: avoid native deserialization, use safe alternatives (JSON with schema validation), and deploy deserialization filters.
Exploit SSRF to reach internal services, cloud metadata endpoints (169.254.169.254), and internal APIs. Cover blind SSRF, DNS rebinding, and protocol smuggling. Implement allowlist-based URL validation, egress filtering, and network segmentation as layered defenses.
Exploit XXE to read local files, perform SSRF, and achieve denial of service through entity expansion (billion laughs). Implement the fix: disable external entity processing in every XML parser you use. Cover the subtle differences between parsers in different languages.
Exploit prototype pollution in JavaScript to modify application behavior, bypass security checks, and achieve denial of service or code execution. Understand how __proto__ and constructor.prototype work. Implement defenses: Object.create(null), Map, and input validation on object keys.
Go beyond basic encryption. Cover authenticated encryption (AES-GCM), digital signatures (ECDSA, Ed25519), key agreement (ECDH, X25519), envelope encryption, and hybrid encryption. Implement each operation hands-on and verify correctness.
Implement certificate pinning in mobile and server-to-server contexts. Deploy mutual TLS (mTLS) for service-to-service authentication. Cover HPKP (deprecated but instructive), pin rotation strategies, and what happens when you get pinning wrong.
Exploit HTTP request smuggling via CL.TE, TE.CL, and TE.TE discrepancies between front-end proxies and back-end servers. Understand how smuggling enables cache poisoning, credential hijacking, and WAF bypass. Implement detection and prevention.
Exploit web cache poisoning through unkeyed headers, query parameters, and fat GET requests. Understand how CDNs and reverse proxies create this attack surface. Implement cache key normalization and header validation as defenses.
Given a complex application with layered defenses, chain multiple vulnerabilities together to achieve the objective (data exfiltration or privilege escalation). This lab requires combining techniques from across the entire course. Scored and debriefed.
Review the advanced attack playbook you take away. Cover ongoing research sources, responsible disclosure practices, and how to bring advanced security testing into your development workflow.
Three days of advanced application security, from OAuth and JWT attacks through HTTP smuggling and multi-vulnerability chaining. For experienced developers and security engineers.
Corporate and sovereign cohorts, and bespoke on-site delivery, on request.