Course Outline
Burp Suite Professional within the IT Audit Workflow
- The tool's role across planning, fieldwork, and reporting phases
- Contrasting manual validation with automated scanning
- Engagement rules and testing authorization protocols
Workspace Configuration, Scoping, and Traffic Capture
- Setting up proxies, browsers, and TLS
- Defining scope rules and protecting out-of-scope assets
- Managing project files and sessions for evidence preservation
HTTP/HTTPS Traffic Analysis and Application Mapping
- Analyzing request/response structures, headers, and cookies
- Building site maps, discovering content, and identifying hidden endpoints
- Reviewing API and JSON traffic
Validating Security Configuration and Transport Controls
- Assessing header, cookie, and CORS configurations
- Reviewing TLS settings, HTTP methods, and error disclosure practices
- Benchmarking against agreed-upon configuration baselines
Testing Authentication Controls
- Evaluating login processes, MFA, and credential policy behavior
- Inspecting session tokens, fixation risks, and logout handling
- Identifying weaknesses in token and JWT validation
Testing Authorization and Access Controls
- Testing horizontal and vertical privilege escalation across roles
- Detecting insecure direct object references and forced browsing
- Documenting role matrix evidence with side-by-side comparisons
Injection, Input Handling, and Out-of-Band Validation
- Confirming injection vulnerabilities without using destructive payloads
- Testing for cross-site scripting and client-side sinks
- Handling blind and out-of-band cases using Collaborator
Business Logic and Workflow Testing
- Verifying multi-step workflows and sequence enforcement
- Detecting tampering with price, quantity, and approval parameters
- Identifying replay, race conditions, and repeat-action abuse
Scanner-Assisted Coverage, Extensions, and AI Assistance
- Configuring crawl and audit settings for scoped coverage
- Triage of issues and validation of false positives
- Creating custom checks with BChecks and extensions
- Leveraging Burp AI and agentic testing with data handling limitations
Evidence Collection and Audit Documentation
- Gathering request and response evidence with timestamps
- Redacting sensitive data and managing evidence securely
- Aligning findings with OWASP Top 10:2025, WSTG, and CWE
- Assigning risk ratings using CVSS v4.0 and audit criteria
Capstone: End-to-End Web Application Control Assessment
- Conducting a scoped assessment of a training application
- Preparing workpapers, a findings register, and a closing debrief
Requirements
- Background in IT auditing and IT security assessments
- Proficient understanding of technology risk, security controls, and network protocols
- Knowledge of HTTP/HTTPS protocols and the OWASP framework
- Basic to intermediate proficiency with web security testing tools, including Kali Linux and OWASP ZAP
Target Audience
- Senior and semi-senior IT auditors
- Technology risk and security control assessors
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
