1.  
2. Trainings 

---

Secure and protect your web applications

at 13 KM

OXiane Luxembourg

Follow

• Training
• Business
• Cybersecurity
• Internet
• Strategy
• Technology
• Programming
• Digital
• Security

Goals
● Discover classic and modern Web threats.
● Identify your weak points.
● Correct your vulnerabilities and develop in a secure way.
● Set up and operate a security "monitoring" system to detect and react to intrusion attempts.

Program

Web applications and threats
● How does the Web work: DNS / HTTP / TLS.
● How do single-page applications work?
● KYA: "Know Your Attacker". Know your attacker.
● Threats: Man In The Browser / Malware Distribution /

Advanced Persistent Threat / Ransomware.
● Risks.

Vulnerabilities

The vulnerabilities presented below will be tested
trainees in the form of an "ethical hacking" workshop on a
deliberately vulnerable application.
● Code injection.
● SQL injection.
● "Broken Authentication and Session Management".
● "Reflected XSS", "Persistent XSS" and "DOM XSS".
● "Insecure Direct Object Reference".
● Configuration errors.
● Exposure of sensitive data.
● Insufficient checks of the data exchanged.
● Cross-Site Request Forgery.
● Use of vulnerable components.
● Unverified redirects.

Single-Page Application and REST API Security
● DOM XSS.
● Client validation vs. API validation.
● Leaks and unauthorized access to API resources.
● Authentication token leak.

TLS, strong authentication and authentication
● Choice of cryptographic algorithms to use.
● Authentication with client certificate and PKCS # 11.
● Authentication with "One-Time Password".

ModSecurity
● Setting up ModSecurity.
● Edit and manage ModSecurity rules.
● ModSecurity scoring system.
● "Virtual patching" with ModSecurity.

"Monitoring" security with ModSecurity and Splunk.
● Correlation of events.
● Creation of dashboards.

Good to know

● Code: DW-SECU
● Duration: 3 days (21 hours)
Public
● Project managers
● Developers
● Type of action: Acquisition of knowledge
● Training resources: Face-to-face training - 1 position per trainee - 1 video projector - Course support provided at each
trainee
● Teaching methods: Presentations - Practical cases - Synthesis
● Validation: Validation exercises - Certificate of internships