Come take the official Samurai-WTF (Web Testing Framework) training course given by one of the founders and lead developers of the project! You will learn the latest Samurai-WTF open source tools and the latest manual techniques to perform an end-to-end penetration test. After a quick overview of pen testing methodology, the instructors will lead you through the process of testing and exploiting web applications, including client side attacks using flaws within the application. We’ll introduce you to the best open source tools currently available, and teach you how these tools integrate with the manual testing techniques. One of the major goals in this course is teaching you the glue that keeps all these techniques and tools together to successfully perform a pen test from beginning to end, which is overlooked in most web pen testing courses.
The majority of the course will be performing an instructor lead, hands-on penetration test. We don’t give you a list of overly simplistic steps to go and do in the corner. Instead, at each stage of the test we present the goals that each testing task is to accomplish and perform pen test along with you on the projector while you are doing it on your own machine. Primary emphasis of these instructor lead exercises is how to integrate these tools into your own manual testing procedures to improve your overall workflow. At the end of course, you will be challenged with a capture the flag event to apply your new skills and knowledge. We will also send you home with several additional vulnerable web apps to practice your new skills at your own pace and experiment with your favorite new tools. This experience will help you gain the confidence and knowledge necessary to perform web application assessments and expose you to the wealth of freely available, open source tools.
This course is designed for novice to intermediate level security professionals, be they developers, managers, or penetration testers.
A basic understanding of web application vulnerabilities and attacks is assumed. This course will focus on use of the tools and their integration into your manual testing procedures, not the theories behind the attacks.
• Laptop with at least two (2) USB ports (three ports preferred)
• Latest VMware Player, VMware Workstation, VWware Fusion installed. Other virtualization software such as Parallels or VirtualBox will probably work if the attendee is familiar with its functionality; however, VMware Player should be prepared as a backup just in case
• Ability to disable all security software on their laptop such as Antivirus and/or firewalls
• At least twenty (20) GB of hard drive space
• At least four (4) GB of RAM
• A pre-release version of the next SamuraiWTF (Web Testing Framework) distribution
• A printed copy of the course slides
• A digital version (PDF) of the course slides that have been open sourced for your use after class
Tim Tomes is a Senior Security Consultant and Developer for Black Hills Information Security with experience in information technology and application development. A veteran, Tim spent several years as an Officer in the United States Army conducting various information security related activities. Tim manages multiple open source projects such as the Recon-ng Framework, the HoneyBadger Geolocation Framework, and PushPin, is a SANS Instructor for SEC542 Web Application Penetration Testing, writes technical articles for PaulDotCom, and frequently presents at information security conferences.
