• Online, Self-Paced
Course Description

Poorly implemented session management can allow an attacker to exploit poor controls and gain access to sensitive information. In Web Application Penetration Testing: Session Management Testing, you'll learn how to find those vulnerabilities before the bad guys do. First, you'll explore cookies, what to look for during a pen-test, and how you can brute force your way passed the login prompt. Next, you'll learn how easy it can be to hijack someone else's session with session fixation. Finally, you'll discover what session puzzling is and how to leverage it as an attacker. When you're finished with this course, you'll have a solid understanding of what to look for while penetration testing session management.

Learning Objectives

  • Testing for Bypassing Session Management Schema
  • Testing for Cookie Attributes
  • Testing for Session Fixation
  • Testing for Exposed Session Variables
  • Testing for Cross-site Request Forgery
  • Testing for Logout Functionality
  • Testing Session Timeout
  • Testing Session Puzzling

Framework Connections

The materials within this course focus on the Knowledge Skills and Abilities (KSAs) identified within the Specialty Areas listed below. Click to view Specialty Area details within the interactive National Cybersecurity Workforce Framework.