Mobile Penetration Testing (OWASP Top 10, Burp Suite, Tools…)

Lab Setup using Android Emulator

Vulnerable apps and VM download

Android Application Pentesting basics

Using Apk-tool,dex2jar,JD-GUI to decompile apps and review the source code

Intercepting HTTP and HTTPS traffic

Insecure Data Storage vulnerabilities

Server side and client side vulnerabilities

Insecure logging

Exported Application components

Client side injection

Android application testing Advance

Introduction to frida

Root detection bypass using Objection

Insecure local data storage

Traffic analysis

Introduction to frida CLI

Introduction to SSL pinning

Bypassing SSL pinning using Frida

Introduction of SOC

What is Enterprise network

what is Defense in Depth

What is Log Parsing

Deep Dive into SOC Environment

What are SIEM deployment options

SIEM Architecture

Splunk Introduction

How to upload data to splunk

what is Splunk Field

Understanding web logs

How to Create Splunk Reports and Dashboard

How to install Splunk Forwarder in windows

Which are impotent Windows Event Codes

Scenarios for SMTP Profiling

DNS Profiling

HTTP traffic profiling

Roles and Responsibilities as a SOC analyst

XXE (XML External Entities)

Exploiting XXE using external entities to retrieve files

Exploiting XXE to perform SSRF attacks

Blind XXE with out-of-band interaction

Blind XXE with out-of-band interaction via XML parameter entities

Exploiting blind XXE to exfiltrate data using a malicious external DTD

Exploiting blind XXE to retrieve data via error messages

Exploiting XInclude to retrieve files

Exploiting XXE via image file upload

Exploiting XXE to retrieve data by repurposing a local DTD

Basic server-side template injection

Basic server-side template injection (code context)

Server-side template injection using documentation

Server-side template injection in an unknown language with a documented exploit

Server-side template injection with information disclosure via user-supplied objects

Server-side template injection in a sandboxed environment

Server-side template injection with a custom exploit

Manipulating Web Socket messages to exploit vulnerabilities

Manipulating the Web Socket handshake to exploit vulnerabilities

Cross-site Web Socket hijacking

Web cache poisoning with an unkeyed header

Web cache poisoning with an unkeyed cookie

Web cache poisoning with multiple headers

Targeted web cache poisoning using an unknown header

Web cache poisoning via an unkeyed query parameter

Parameter cloaking

Web cache poisoning via a fat GET request

URL normalization

Combining web cache poisoning vulnerabilities

Cache key injection

Internal cache poisoning

Modifying serialized objects

Modifying serialized data types

Using application functionality to exploit insecure deserialization

Arbitrary object injection in PHP

Exploiting Java deserialization with Apache Commons

Exploiting PHP deserialization with a pre-built gadget chain

Exploiting Ruby deserialization using a documented gadget chain

Developing a custom gadget chain for Java deserialization

Developing a custom gadget chain for PHP deserialization

Using PHAR deserialization to deploy a custom gadget chain

JWT authentication bypass via unverified signature

JWT authentication bypass via flawed signature verification

JWT authentication bypass via weak signing key

JWT authentication bypass via jwk header injection

JWT authentication bypass via jku header injection

JWT authentication bypass via kid header path traversal

JWT authentication bypass via algorithm confusion

JWT authentication bypass via algorithm confusion with no exposed key

Introduction to red team concepts and methodologies

Cyber kill chain

Initial vectors of compromise(Mitre ATT&CK framework)

C2 framework(Covenant and empire)

Cobalt Strike

Relevant Red team tools(Bloodhound,Mimikatz,Impacket,Powersploit)

Intermediate windows and linux commands

Process Injection

Lateral Movement

Port Forwarding

Adversary Emulation(APT3)

How web API works

Threat Modeling an API Test

THE ANATOMY OF WEB APIS

REST API Specifications

API Authentication

Information Disclosure

Broken Object Level Authorization

Broken User AuthenticationBroken User Authentication

Excessive Data Exposure

Lack of Resources and Rate Limiting

Broken Function Level Authorization

Mass Assignment

Security Misconfigurations

Injections

Improper Assets Management

Business Logic Vulnerabilities

Passive Recon

Active Recon

Endpoint Analysis

FUZZING

Automating Mass Assignment Attacks with Arjun and Burp Suite Intruder

Attacking GraphQL

Architecture, Discovery, and Recon at Scale

Attacking Identity Systems

Attacking and Abusing Cloud Services

Vulnerabilities in Cloud-Native Applications

Infrastructure Attacks and Red Teaming