Course Outline
Burp Suite Professional within the IT Audit Workflow
- The tool's function during planning, fieldwork, and reporting phases
- Manual verification compared to automated scanning
- Rules of engagement and testing authorization
Workspace Setup, Scoping, and Traffic Interception
- Configuring proxy, browser, and TLS settings
- Defining scope rules and protecting out-of-scope assets
- Managing project files and sessions for evidence retention
HTTP/HTTPS Traffic Examination and Application Mapping
- Analyzing request/response structures, headers, and cookies
- Reviewing site maps, content discovery, and hidden endpoints
- Inspecting API and JSON traffic
Verifying Security Configurations and Transport Controls
- Auditing header, cookie, and CORS configurations
- Checking TLS settings, HTTP methods, and error disclosure
- Benchmarking against agreed configuration baselines
Testing Authentication Controls
- Evaluating login, MFA, and credential policy behaviour
- Assessing session tokens, fixation risks, and logout processes
- Identifying weaknesses in token and JWT validation
Testing Authorization and Access Controls
- Testing horizontal and vertical privileges across different roles
- Detecting insecure direct object references and forced browsing
- Creating role matrix evidence through side-by-side comparison
Injection, Input Processing, and Out-of-Band Verification
- Confirming injection flaws without destructive payloads
- Testing for Cross-Site Scripting and client-side vulnerabilities
- Addressing blind and out-of-band cases using Collaborator
Testing Business Logic and Workflows
- Enforcing multi-step workflows and sequence integrity
- Detecting tampering of price, quantity, and approval parameters
- Identifying replay, race conditions, and repeat-action abuse
Scanner-Assisted Coverage, Extensions, and AI Support
- Configuring crawl and audit features for scoped coverage
- Triaging issues and validating false positives
- Developing custom checks using BChecks and extensions
- Utilizing Burp AI and agentic testing with data handling constraints
Collecting Evidence and Preparing Audit Documentation
- Recording request/response evidence with accurate timestamps
- Handling evidence and redacting sensitive data
- Aligning findings with OWASP Top 10:2025, WSTG, and CWE
- Rating risk using CVSS v4.0 and audit criteria
Capstone: Comprehensive Web Application Control Assessment
- Conducting a scoped assessment of a training application
- Preparing workpapers, findings registers, and conducting a closing debrief
Requirements
- Proficiency in IT auditing and IT security assessments
- Practical understanding of technology risk, security controls, and network protocols
- Knowledge of HTTP/HTTPS and the OWASP framework
- Basic to intermediate experience with web security testing tools such as Kali Linux and OWASP ZAP
Target Audience
- Senior and semi-senior IT auditors
- Technology risk and security control assessors
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
