Course Outline
Integrating Burp Suite Professional into the IT Audit Cycle
- The tool's role across planning, fieldwork, and reporting phases.
- Differentiating manual verification from automated scanning.
- Defining engagement rules and obtaining testing authorization.
Workspace Setup, Scoping, and Traffic Capture
- Configuring the proxy, browser, and TLS settings.
- Establishing scope rules and safeguards for out-of-scope targets.
- Managing project files and sessions for evidence preservation.
Analyzing HTTP/HTTPS Traffic and Mapping Applications
- Examining request and response structures, headers, and cookies.
- Using site maps, content discovery, and hidden endpoint analysis.
- Reviewing API and JSON traffic flows.
Verifying Security Configuration and Transport Controls
- Auditing header, cookie, and CORS configurations.
- Checking TLS settings, HTTP methods, and error message disclosure.
- Benchmarking findings against agreed-upon configuration baselines.
Testing Authentication Controls
- Evaluating login mechanisms, MFA, and credential policies.
- Inspecting session tokens, fixation risks, and logout processes.
- Identifying weaknesses in token and JWT validation.
Assessing Authorization and Access Controls
- Testing horizontal and vertical privilege escalation across roles.
- Detecting insecure direct object references and forced browsing issues.
- Compiling role matrix evidence through side-by-side comparisons.
Injection, Input Handling, and Out-of-Band Verification
- Confirming injection vulnerabilities without using destructive payloads.
- Testing for cross-site scripting and client-side sinks.
- Addressing blind and out-of-band scenarios using Collaborator.
Business Logic and Workflow Assessment
- Reviewing multi-step workflows and sequence enforcement.
- Testing for tampering with price, quantity, and approval parameters.
- Identifying replay, race conditions, and repeat-action abuses.
Leveraging Scanner Coverage, Extensions, and AI Assistance
- Configuring crawl and audit features for scoped coverage.
- Triaging issues and validating false positives.
- Developing custom checks using BChecks and extensions.
- Utilizing Burp AI and agentic testing within data handling constraints.
Collecting Evidence and Documenting for Audit
- Capturing request and response evidence with precise timestamps.
- Managing redaction of sensitive data and evidence handling protocols.
- Aligning findings with OWASP Top 10:2025, WSTG, and CWE standards.
- Assigning risk ratings using CVSS v4.0 and audit criteria.
Capstone: Comprehensive Web Application Control Assessment
- Conducting a scoped assessment of a training application.
- Preparing workpapers, findings registers, and conducting a closing debrief.
Requirements
- Professional experience in IT auditing and security assessment.
- Proficiency in technology risk, security controls, and network protocols.
- Understanding of HTTP/HTTPS protocols and the OWASP framework.
- Familiarity with web security testing tools, such as Kali Linux and OWASP ZAP, at a basic to intermediate level.
Target Audience
- Senior and semi-senior IT auditors.
- Specialists in technology risk and security control assessment.
Custom Corporate Training
Training solutions designed exclusively for businesses.
- Customized Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
- Flexible Schedule: Dates and times adapted to your team's agenda.
- Format: Online (live), In-company (at your offices), or Hybrid.
Price per private group, online live training, starting from 4800 € + VAT*
Contact us for an exact quote and to hear our latest promotions
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
