Web Application Penetration Testing: Session Management Testing

Learn what to look for while penetration testing session management using OWASP principles including brute-forcing, taking advantage of poorly implemented session fixation, and POST and GET requests implemented incorrectly to find weak spots.
Course info
Level
Intermediate
Updated
Mar 8, 2018
Duration
2h 1m
Table of contents
Description
Course info
Level
Intermediate
Updated
Mar 8, 2018
Duration
2h 1m
Description

Poorly implemented session management can allow an attacker to exploit poor controls and gain access to sensitive information. In Web Application Penetration Testing: Session Management Testing, you’ll learn how to find those vulnerabilities before the bad guys do. First, you'll explore cookies, what to look for during a pen-test, and how you can brute force your way passed the login prompt. Next, you'll learn how easy it can be to hijack someone else's session with session fixation. Finally, you’ll discover what session puzzling is and how to leverage it as an attacker. When you’re finished with this course, you'll have a solid understanding of what to look for while penetration testing session management.

About the author
About the author

Clark holds an Offensive Security Certified Professional (OSCP) certification and is currently part of the uTest.com security team and is part of Synack.com's red team, participating in finding security vulnerabilities.