Course Outline
Burp Suite Professional within the IT Audit Workflow
- The role of the tool in planning, fieldwork, and reporting
- Manual verification versus automated scanning
- Rules of engagement and testing authorization protocols
Workspace Setup, Scope Definition, and Traffic Capture
- Configuring the proxy, browser, and TLS
- Defining scope rules and protecting out-of-scope assets
- Managing project files and sessions for evidence retention
HTTP/HTTPS Traffic Analysis and Application Mapping
- Examining request/response structures, headers, and cookies
- Reviewing site maps, content discovery, and hidden endpoints
- Analyzing API and JSON traffic
Validating Security Configuration and Transport Controls
- Reviewing header, cookie, and CORS configurations
- Checking TLS settings, HTTP methods, and error disclosure policies
- Comparing findings against established configuration baselines
Testing Authentication Controls
- Evaluating login mechanisms, MFA, and credential policies
- Assessing session tokens, fixation risks, and logout handling
- Identifying weaknesses in token and JWT validation
Testing Authorization and Access Controls
- Conducting horizontal and vertical privilege tests across roles
- Checking for insecure direct object references and forced browsing
- Documenting role matrix evidence and comparative analysis
Injection, Input Handling, and Out-of-Band Verification
- Confirming injection vulnerabilities without destructive payloads
- Testing cross-site scripting and client-side sinks
- Addressing blind and out-of-band cases using Collaborator
Business Logic and Workflow Testing
- Testing multi-step workflows and sequence enforcement
- Checking for parameter tampering related to price, quantity, and approvals
- Identifying replay attacks, race conditions, and repeat-action abuse
Scanner-Assisted Coverage, Extensions, and AI Support
- Configuring crawl and audit for targeted coverage
- Triaging issues and validating false positives
- Implementing custom checks via BChecks and extensions
- Utilizing Burp AI and agentic testing while adhering to data handling limits
Evidence Collection and Audit Documentation
- Collecting request and response evidence with timestamps
- Redacting sensitive data and managing evidence properly
- Aligning findings with OWASP Top 10:2025, WSTG, and CWE
- Risk assessment using CVSS v4.0 and audit criteria
Capstone: Comprehensive Web Application Control Assessment
- Performing a scoped assessment on a training application
- Preparing workpapers, findings registers, and closing debriefs
Requirements
- Experience in IT auditing and IT security assessments
- Practical knowledge of technology risk, security controls, and network protocols
- Familiarity with HTTP/HTTPS and the OWASP framework
- Basic to intermediate proficiency with web security testing tools such as Kali Linux and OWASP ZAP
Audience
- Senior and semi-senior IT auditors
- Technology risk and security control assessors
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
