دوره جامع تست نفوذ وب

• Introduction to JS Programming
• Chrome V8, SpiderMonkey, Chakra
• Document Object Model (DOM)
• Conditions and Loops
• Functions and Event Handlers
• Asynchronous Programming

• Databases (SQL, NoSQL), RDBMS, Query Language and ORM Concepts
• Install and Configure MySQL and phpMyadmin
• Database, Table and Columns Concepts
• Create, Read, Update, Delete (CRUD)
• Union, Read File, Write File, Hex

• Introduction to PHP
• Variables, Arrays, I/O
• Conditions and Loops
• Functions
• Hypertext Transfer Protocol
• Introduction to HTTP
• HTTP in-depth
• URL Structure
• HTTP Packets
• HTTP Versions
• HTTP/2
• Introduction to HTTP/2
• HTTP/2 Multiplexing
• HTTP/2 Server Push
• HTTP/3
• Introduction to HTTP/3
• QUIC Protocol
• HTTP Packet Crafting
• HTTP Methods
• Vulnerable/Dangerous Functions
• Database Connection (MySQL)

• Basic Authentication
• Digest Authentication
• Form-Based Authentication
• OAuth2 Concepts
• Username Enumeration Vulnerability
• Cookies & Session
• Session Fixation Vulnerability
• Testing for Logout Functionality
• Cookie Replay Attacks in ASP.Net
• Hash-Based Message Authentication Code (HMAC)

• JWT Structure in-depth
• JWT Attacks
• Crack JWT
• None Algorithm JWT

• IFrame Injection to Cross-Site Scripting (XSS)

• SMTP Injection Vulnerability

• OS Command Injection
• Blind OS Command Injection
• OS Command Injection Bypassing Techniques

• PHP Code Injection

• Introduction to SQLi
• Types of SQLi
• UNION-Based Techniques
• SQLi Bypassing Techniques
• SQLMap

• Different Types of Captcha Bypassing
• Browser Extensions
• Manual Bypassing (SentryMBA)
• Captcha Bypassing Misconfigurations

• Brute-Force Attacks
• Dictionary Attacks
• Rainbow Tables
• Burp Suite Intruder in-depth

• Cross-site Request Forgery (CSRF) Exploitation
• CSRF Token Bypassing Techniques
• Analyzing Token Entropy
• Imeplementation Misconfigurations

• CSRF Token Bypassing via Clickjacking

• Reflected
• Stored
• DOM-Based
• BeEF Framework
• XSS to CSRF Technique

• Web Cache Poisoning
• Host Header Injection to Account Takeover
• Host Header Injection to Cross-Site Scripting (XSS)

• Same-Origin Policy (SOP)
• Cross-Origin Resource Sharing (CORS) in-depth
• Exploiting Insecure CORS

• Local File Inclusion (LFI)
• Remote File Inclusion (RFI)
• LFI Bypassing Techniques
• LFI to RCE
• Log Poisoning
• PHP Wrappers
• RFI Bypassing Techniques
• PHP Streams

• Serialization .vs. Deserialization
• Missing Access Control
• PHP Object Injection
• Magic Methods
• POP Chains
• Analyzing CVE-2020-9484

• Introduction to XMLs
• DTD Files & XML Entities
• XXE Exploitation

• Introduction to postMessage
• Types of postMessage Misconfiguration
• Exploit Misconfiguration Types

• Introduction to WebSocket
• WebSocket in-depth
• WebSocket Vulnerabilities
• Exploit WebSocket Misconfigurations
• Cross-Site WebSocket Hijacking (CSWSH) Exploitaion

• X-Content-Type-Options HTTP Header
• Shell Uploading
• Shell Upload Bypassing Techniques
• Malicious WAR Files

• Security Best Practices
• Information Gathering
• Username Enumeration Techniques
• WPScan

• Introduction to GraphQL
• Introspection Query
• Types of Misconfiguration in GraphQL

• Broken Object Level Authorization
• Broken Authentication
• Excessive Data Exposure
• Lack of Resources and Rate Limiting
• Broken Function Level Authorization
• Mass Assignment
• Security Misconfiguration
• Injection
• Improper Assets Management
• Insufficient Logging and Monitoring

• Web Security Testing Guide (WSTG v4.2)
• CVSS 2/3

Introduction to Python
Python Basic Concepts
Conditions and Loops
Multi-Threading
Python Libraries for Penetration Testing
requests
re
base64
hashlib
pyjwt