SANS SEC542.1 Introduction and Information Gathering

فهرست مطالب کتاب Introduction and Information Gathering:

Why the Web?

Application Assessment Methodologies

Web Application Pen Tester’s Toolkit

Interception Proxies

EXERCISE: Configuring Interception Proxies

Open Source Intelligence (OSINT)

Virtual Host Discovery

EXERCISE: Virtual Host Discovery

HTTP Syntax and Semantics

HTTPS and Testing for Weak Ciphers

EXERCISE: Testing HTTPS

Target Profiling

SANS SEC542.3 Injection

فهرست مطالب کتاب SANS SEC542.3 Injection:

HTTP Response Security Controls

Command Injection

EXERCISE: Command Injection

File Inclusion and Directory Traversal

EXERCISE: Local/Remote File Inclusion

Insecure Deserialization

EXERCISE: Insecure Deserialization

SQL Injection Primer

Discovering SQLi

Exploiting SQLi

EXERCISE: Error-Based SQLi

SQLi Tools

EXERCISE:sqlmap + ZAP

Summary

SANS SEC542.4 XSS, SSRF, and XXE

فهرست مطالب کتاب SANS SEC542.4 XSS, SSRF, and XXE:

Document Object Model (DOM)

Cross-Site Scripting (XSS) Primer

Exercise: HTML Injection

XSS Impacts

BeEF

Exercise: BeEF

Classes of XSS

Exercise: DOM-Based XSS

Discovering XSS

XSS Tools

Exercise: XSS

AJAX

Data Attacks

REST and SOAP

Server-Side Request Forgery (SSRF)

Exercise: Server-Side Request Forgery

XML External Entities (XXE)

Exercise: XXE

Summary

SANS SEC542.5 CSRF, Logic Flaws, and Advanced

فهرست مطالب کتاب SANS SEC542.5 CSRF, Logic Flaws, and Advanced:

Cross-Site Request Forgery

Exercise: CSRF

Logic Flaws

Python for Web App Pen Testers

Exercise: Python

WPScan and ExploitDB

Exercise: WPScan and ExploitDB

Burp Scanner

Metasploit

Exercise: Metasploit/Drupalgeddon II

Nuclei

Exercise: Nuclei/Jenkins

When Tools Fail

Exercise: When Tools Fail

Business of Pen Testing: Preparation

Business of Pen Testing: Post Assessment

Summary

Bonus Exercise: Bonus Challenges

SANS SEC555.1 SIEM Architecture

فهرست مطالب کتاب SANS SEC555.1 SIEM Architecture:

State of the SIEM

SIEM Planning

EXERCISE: DeTTect, Visualize Visibility and Detection Capabilities

Log Collection

EXERCISE: Introduction to SIEM Architecture

Log Aggregation and Parsing

EXERCISE: Log Ingestion from Files and Network Connections

EXERCISE: Log Enrichment and Parsing

Log Broker

Log Storage

Alerting and Analysis

EXERCISE: Tactical Alerting

SANS SEC555.2 Service Profiling with SIEM

فهرست مطالب کتاب SANS SEC555.2 Service Profiling with SIEM:

Major Networking Services

Service Log Collection

Log Enrichment

EXERCISE: Enrichment, Adding Context

SMTP

DNS

EXERCISE: Catching the Adversary with DNS

HTTP

EXERCISE: Investigating HTTP

TLS

EXERCISE: HTTPS Analysis

SANS SEC555.3 Advanced Endpoint Analytics

فهرست مطالب کتاب SANS SEC555.3 Advanced Endpoint Analytics:

Windows Logging

Linux Logging

Endpoint Collection Strategies

EXERCISE: Windows Log Filtering

Events of Interest

EXERCISE: CatchingEvil with Windows Logs

Host-based Firewalls

Login Events

EXERCISE: Login Monitoring

OS Protection

Container Logging

EXERCISE: Docker Monitoring

SANS SEC555.4 Baselining and User Behavior Monitoring

فهرست مطالب کتاب SANS SEC555.4 Baselining and User Behavior Monitoring:

Getting to Know Yourself

Active Device Discovery

Passive Device Discovery

EXERCISE: Master Inventory

Software Monitoring

Scripting

EXERCISE: PowerShell Compromise

Traffic Monitoring

EXERCISE: NetFlow Detection

User Monitoring

Tactical Baselining

EXERCISE: Cloud Monitoring

SANS SEC555.5 Tactical SIEM Detection and Post-Mortem Analysis

فهرست مطالب کتاب SANS SEC555.5 Tactical SIEM Detection and Post-Mortem Analysis:

Centralized Alerting

SIEM Alerting

EXERCISE: Sigma, MITRE and Universal Alerts

Intrusion Detection Systems

Analyzing Alerts

EXERCISE: Alert Context

External Analysis Tools

Case Management

Reverse Analysis

Tripwire Detection

EXERCISE: Virtual Tripwires

Post-Mortem Analysis

EXERCISE: Beacon Detection