Course Outline
Integrating Burp Suite Professional into the IT Audit Lifecycle
- The tool's role during planning, fieldwork, and reporting phases
- Differentiating between manual verification and automated scanning
- Establishing rules of engagement and obtaining testing authorization
Workspace Setup, Scoping, and Traffic Acquisition
- Configuring the proxy, browser, and TLS settings
- Defining scope rules and safeguards for out-of-scope resources
- Managing project files and sessions to preserve evidence
HTTP/HTTPS Traffic Inspection and Application Mapping
- Analyzing request and response structures, headers, and cookies
- Utilizing site maps, content discovery, and locating hidden endpoints
- Reviewing API and JSON traffic flows
Verifying Security Configuration and Transport Controls
- Evaluating header, cookie, and CORS configurations
- Checking TLS settings, HTTP methods, and error message disclosure
- Aligning observations with agreed configuration baselines
Testing Authentication Controls
- Assessing login, MFA, and credential policy behavior
- Examining session tokens, fixation risks, and logout processes
- Identifying token and JWT validation weaknesses
Assessing Authorization and Access Controls
- Testing horizontal and vertical privilege escalation across roles
- Detecting insecure direct object references and forced browsing attempts
- Generating role matrix evidence and performing side-by-side comparisons
Injection, Input Processing, and Out-of-Band Verification
- Confirming injection vulnerabilities using non-destructive payloads
- Testing for cross-site scripting and client-side vulnerabilities
- Handling blind and out-of-band scenarios using Collaborator
Business Logic and Workflow Assessment
- Evaluating multi-step workflows and sequence enforcement
- Testing for tampering with price, quantity, and approval parameters
- Identifying replay attacks, race conditions, and repeated action abuse
Enhancing Coverage with Scanners, Extensions, and AI
- Configuring crawl and audit settings for scoped coverage
- Triage issues and verify false positives
- Implementing custom checks using BChecks and extensions
- Utilizing Burp AI and agentic testing while observing data handling constraints
Evidence Gathering and Audit Documentation
- Capturing request and response evidence with precise timestamps
- Redacting sensitive information and managing evidence handling
- Correlating findings with OWASP Top 10:2025, WSTG, and CWE
- Assigning risk ratings using CVSS v4.0 and relevant audit criteria
Capstone: Comprehensive Web Application Control Assessment
- Conducting a scoped assessment of a dedicated training application
- Producing workpapers, a findings register, and a concluding debrief
Requirements
- Practical experience in IT auditing and IT security assessment
- Proficiency in technology risk, security controls, and network protocols
- Understanding of HTTP/HTTPS mechanics and the OWASP framework
- Basic to intermediate proficiency with web security testing tools such as Kali Linux and OWASP ZAP
Target Audience
- Senior and semi-senior IT auditors
- Technology risk and security control assessors
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
