Poorly implemented session management can allow an attacker to exploit poor controls and gain access to sensitive information. In Web Application Penetration Testing: Session Management Testing, you’ll learn how to find those vulnerabilities before the bad guys do. First, you’ll explore cookies, what to look for during a pen-test, and how you can brute force your way passed the login prompt. Next, you’ll learn how easy it can be to hijack someone else’s session with session fixation. Finally, you’ll discover what session puzzling is and how to leverage it as an attacker. When you’re finished with this course, you’ll have a solid understanding of what to look for while penetration testing session management.
Author Name: Clark Voss
Author Description:
Clark has over 17 years of experience in all facets of information technology, from Desktop Support, Network Administration, System Administration, Software Quality Control, and Software generation. Now Clark is focusing his efforts on Information Security. Clark has received his Offensive Security Certified Professional (OSCP) certification. He is currently part of the uTest.com security team and is part of Synack.com’s red team, participating in finding security vulnerabilities in everything f… more

Table of Contents

• Course Overview
  1min
• Course Introduction
  2mins
• Testing for Bypassing Session Management Schema
  29mins
• Testing for Cookie Attributes
  16mins
• Testing for Session Fixation
  7mins
• Testing for Exposed Session Variables
  16mins
• Testing for Cross-site Request Forgery
  8mins
• Testing for Logout Functionality
  8mins
• Testing Session Timeout
  10mins
• Testing Session Puzzling
  11mins
• Course Wrap-up
  6mins