Course Outline
Burp Suite Professional in the IT Audit Process
- The role of the tool across planning, fieldwork, and reporting phases.
- Contrasting manual validation with automated scanning.
- Rules of engagement and testing authorization protocols.
Workspace Configuration, Scope Definition, and Traffic Capture
- Setup of proxy, browser, and TLS configurations.
- Defining scope rules and protecting out-of-scope assets.
- Managing project files and sessions for evidence integrity.
HTTP/HTTPS Traffic Analysis and Application Mapping
- Analyzing request and response structures, headers, and cookies.
- Utilizing site maps, content discovery, and identifying hidden endpoints.
- Reviewing API and JSON traffic patterns.
Security Configuration and Transport Control Validation
- Reviewing header, cookie, and CORS configurations.
- Evaluating TLS settings, HTTP methods, and error disclosure mechanisms.
- Comparing configurations against agreed baselines.
Authentication Control Testing
- Assessing login, MFA, and credential policy behaviors.
- Examining session tokens, fixation risks, and logout handling.
- Identifying weaknesses in token and JWT validation.
Authorization and Access Control Testing
- Conducting horizontal and vertical privilege testing across roles.
- Detecting insecure direct object references and forced browsing vulnerabilities.
- Generating role matrix evidence and performing side-by-side comparisons.
Injection, Input Handling, and Out-of-Band Validation
- Confirming injection vulnerabilities without using destructive payloads.
- Testing cross-site scripting and client-side sinks.
- Handling blind and out-of-band cases using Collaborator.
Business Logic and Workflow Testing
- Validating multi-step workflows and sequence enforcement.
- Testing price, quantity, and approval parameter tampering.
- Identifying replay attacks, race conditions, and repeat-action abuse.
Scanner-Assisted Coverage, Extensions, and AI Assistance
- Configuring crawl and audit settings for scoped coverage.
- Triage of issues and validation of false positives.
- Implementing custom checks with BChecks and extensions.
- Utilizing Burp AI and agentic testing within data handling limits.
Evidence Collection and Audit Documentation
- Capturing request and response evidence with timestamps.
- Redacting sensitive data and managing evidence handling protocols.
- Mapping findings to OWASP Top 10:2025, WSTG, and CWE.
- Assigning risk ratings using CVSS v4.0 and audit criteria.
Capstone: End-to-End Web Application Control Assessment
- Conducting a scoped assessment of a training application.
- Preparing workpapers, a findings register, and a closing debrief.
Requirements
- Experience in IT auditing and IT security assessment.
- Working knowledge of technology risk, security controls, and network protocols.
- Familiarity with HTTP/HTTPS and the OWASP framework.
- Basic to intermediate proficiency in using web security testing tools such as Kali Linux and OWASP ZAP.
Audience
- Senior and semi-senior IT auditors.
- Technology risk and security control assessors.
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
