1
1

00:00:00,210  -->  00:00:01,620
<v ->In this section of the course,</v>
2

2

00:00:01,620  -->  00:00:04,260
we're going to cover mitigating web application vulnerabilities
3

3

00:00:04,260  -->  00:00:05,370
and attacks.
4

4

00:00:05,370  -->  00:00:06,960
Now, in the last section of the course,
5

5

00:00:06,960  -->  00:00:08,970
we were focused on software vulnerabilities,
6

6

00:00:08,970  -->  00:00:11,700
but this time, we're going to be focused on web applications
7

7

00:00:11,700  -->  00:00:15,060
and their vulnerabilities as we return back into domain 2,
8

8

00:00:15,060  -->  00:00:17,670
vulnerability management in this section of the course.
9

9

00:00:17,670  -->  00:00:18,540
Now, once more,
10

10

00:00:18,540  -->  00:00:21,870
we're going to be focused on objectives 2.4 and 2.5.
11

11

00:00:21,870  -->  00:00:24,540
Objective 2.4 states, that given a scenario,
12

12

00:00:24,540  -->  00:00:26,310
you must be able to recommend controls
13

13

00:00:26,310  -->  00:00:28,830
and mitigate attacks and software vulnerabilities.
14

14

00:00:28,830  -->  00:00:30,540
And objective 2.5 states,
15

15

00:00:30,540  -->  00:00:32,190
you must be able to explain concepts
16

16

00:00:32,190  -->  00:00:35,520
related to vulnerability response, handling, and management.
17

17

00:00:35,520  -->  00:00:36,990
Now, as we move through this section,
18

18

00:00:36,990  -->  00:00:38,970
we're going to be discussing a lot of different types
19

19

00:00:38,970  -->  00:00:40,800
of vulnerabilities and attacks,
20

20

00:00:40,800  -->  00:00:42,840
including things like directory traversals,
21

21

00:00:42,840  -->  00:00:45,210
cross-site scripting, SQL injections,
22

22

00:00:45,210  -->  00:00:47,070
and XML vulnerabilities.
23

23

00:00:47,070  -->  00:00:50,040
Then we'll discuss some of the secure coding best practices
24

24

00:00:50,040  -->  00:00:51,150
that you can use to help prevent
25

25

00:00:51,150  -->  00:00:52,500
some of these types of attacks
26

26

00:00:52,500  -->  00:00:53,610
and the different vulnerabilities
27

27

00:00:53,610  -->  00:00:55,740
from being exploited in the first place.
28

28

00:00:55,740  -->  00:00:58,350
Next, we're going to go and talk about other attacks,
29

29

00:00:58,350  -->  00:01:01,380
things like authentication attacks, session hijacking,
30

30

00:01:01,380  -->  00:01:03,060
server-side request forgery,
31

31

00:01:03,060  -->  00:01:05,700
sensitive data exposures, and clickjacking.
32

32

00:01:05,700  -->  00:01:07,650
After that, we're going to do a demonstration
33

33

00:01:07,650  -->  00:01:10,410
to assess the impact of web application vulnerabilities
34

34

00:01:10,410  -->  00:01:11,940
by seeing some of them in action
35

35

00:01:11,940  -->  00:01:14,580
as I perform some basic penetration testing techniques
36

36

00:01:14,580  -->  00:01:16,740
against a vulnerable web application.
37

37

00:01:16,740  -->  00:01:18,570
And finally, we're going to take a short quiz
38

38

00:01:18,570  -->  00:01:20,640
to see what you learned during this section of the course.
39

39

00:01:20,640  -->  00:01:22,290
Interview each of those quiz questions
40

40

00:01:22,290  -->  00:01:25,080
to ensure you can explain why the right answers were right.
41

41

00:01:25,080  -->  00:01:26,580
So let's start exploring the world
42

42

00:01:26,580  -->  00:01:28,740
of web application vulnerabilities and attacks,
43

43

00:01:28,740  -->  00:01:30,240
as well as how to best mitigate them
44

44

00:01:30,240  -->  00:01:31,740
in this section of the course.