Call : (+91) 968636 4243
Mail : info@EncartaLabs.com
EncartaLabs

Python Security

( Duration: 3 Days )

The Python Security training course provides skills to address the most critical secure code issues when developing Python applications. You will learn about the OWASP Top 10 vulnerabilities and how to address them in the code. The course also covers significant security issues for Python code in general and explores JSON security and security testing.

By attending Python Security workshop, delegates will learn to:

  • Understand Web application security issues
  • Analyze the OWASP Top Ten elements
  • Put Web application security in the context of Python
  • Go beyond the low hanging fruits
  • Handle security challenges in your Python code
  • Identify vulnerabilities and their consequences
  • Security best practices in Python
  • Understand security testing methodology and approaches
  • Get familiar with common security testing techniques and tools

  • Python Development Experience.

COURSE AGENDA

1

Introduction

2

Cybersecurity Basics

  • What is security?
  • Threat and risk
  • Cybersecurity threat types
  • Consequences of insecure software
  • Constraints and the market
  • The dark side
3

The OWASP Top Ten (Part I)

  • OWASP Top 10 – 2017
  • Injection
    • Injection principles
    • Injection attacks
    • SQL injection
  • SQL injection best practices
    • Input validation
    • Parameterized queries
    • Additional considerations
    • Case study – Hacking Fortnite accounts
    • Testing for SQL injection
  • SQL injection and ORM
    • Parameter manipulation
    • CRLF injection
    • Code injection
    • Injection best practices
  • Broken authentication
    • Authentication basics
    • Authentication weaknesses
    • Spoofing on the Web
    • Testing for weak authentication
    • Case study – PayPal 2FA bypass
    • User interface best practices
    • Password management
4

The OWASP Top Ten (Part II)

  • Broken authentication
    • Password management
    • Session management
    • Cookie security
  • Sensitive data exposure
    • Information exposure
    • Exposure through extracted data and aggregation
    • Case study – Strava fitness app data exposure
    • System information leakage
  • Information exposure best practices
    • Error and exception handling principles
    • Information exposure through error reporting
    • Information leakage via error pages
  • XML External Entities (XXE)
    • DTD and the entities
    • Entity expansion
    • Attribute blowup
    • External Entity Attack (XXE)
  • Broken access control
    • Access control basics
    • Failure to restrict URL access
    • Testing for authorization issues
    • Confused deputy
  • File upload
    • Unrestricted file upload
    • Good practices
    • Testing for file upload vulnerabilities
  • Security misconfiguration
    • Configuration principles
    • Configuration management
    • Server misconfiguration
    • Python configuration best practices
  • Cross-Site Scripting (XSS)
    • Cross-site scripting basics
    • Cross-site scripting types
  • XSS protection best practices
    • Protection principles – escaping
    • XSS protection APIs in Python
    • XSS protection in Jinja2
    • Additional protection layers
    • Client-side protection principles
    • Blacklisting-based XSS protection evasion
    • Testing for XSS
5

The OWASP Top Ten (Part III)

  • Frame Sandboxing
    • Serialization and deserialization challenges
    • Deserializing untrusted streams
    • Deserialization with pickle
    • Deserialization with PyYAML
    • Deserializing best practices
    • Testing for insecure deserialization
  • Web Application Security Beyond the Top Ten
    • Using vulnerable components
    • Assessing the environment
    • Hardening
    • Untrusted functionality import
    • Malicious packages in Python
    • Importing JavaScript
    • Case study – The British Airways data breach
    • Vulnerability management
  • Insufficient Logging & Monitoring
    • Logging and monitoring principles
    • Insufficient logging
    • Plaintext passwords at Facebook
    • Logging best practices
    • Monitoring best practices
  • Using Components with Known Vulnerabilities
    • Client-side security
    • Same Origin Policy
  • Insecure Deserialization
    • Cross-Frame Scripting (XFS) attack
    • Clickjacking beyond hijacking a click
    • Clickjacking protection best practices
6

Common Software Security Weaknesses

  • Input validation
7

JSON Security

  • JSON injection
  • Dangers of JSONP
  • JSON/JavaScript hijacking
  • Best practices
  • ReactJS vulnerability in HackerOne
8

Security Testing

  • Security testing vs functional testing
  • Manual and automated methods
  • Security testing techniques and tools
    • Code analysis
    • Dynamic analysis
9

Wrap Up

  • Secure coding principles
    • Principles of robust programming by Matt Bishop
    • Secure design principles of Saltzer and Schröder
  • And now what?
    • Further sources and readings
    • Python resources

Encarta Labs Advantage

  • One Stop Corporate Training Solution Providers for over 6,000 various courses on a variety of subjects
  • All courses are delivered by Industry Veterans
  • Get jumpstarted from newbie to production ready in a matter of few days
  • Trained more than 50,000 Corporate executives across the Globe
  • All our trainings are conducted in workshop mode with more focus on hands-on sessions

View our other course offerings by visiting https://www.encartalabs.com/course-catalogue-all.php

Contact us for delivering this course as a public/open-house workshop/online training for a group of 10+ candidates.

Top
Notice
X