Course Outline
The Role of Burp Suite Professional in IT Auditing
- The tool’s function across planning, fieldwork, and reporting phases
- Differences between manual verification and automated scanning
- Testing rules of engagement and authorization protocols
Workspace Setup, Scoping, and Traffic Capture
- Proxy, browser, and TLS configuration
- Defining scope rules and protecting out-of-scope assets
- Managing project files and sessions for evidentiary purposes
HTTP/HTTPS Traffic Analysis and Application Mapping
- Examining request and response structures, headers, and cookies
- Building site maps, discovering content, and identifying hidden endpoints
- Reviewing API and JSON traffic
Validating Security Configuration and Transport Controls
- Reviewing header, cookie, and CORS configurations
- Analyzing TLS settings, HTTP methods, and error disclosure
- Comparing findings against established configuration baselines
Testing Authentication Controls
- Evaluating login, MFA, and credential policy behaviors
- Examining session tokens, fixation risks, and logout handling
- Identifying weaknesses in token and JWT validation
Testing Authorization and Access Controls
- Testing horizontal and vertical privilege escalation across roles
- Identifying insecure direct object references and forced browsing issues
- Gathering role matrix evidence and performing side-by-side comparisons
Injection, Input Handling, and Out-of-Band Validation
- Confirming injection risks without using destructive payloads
- Testing cross-site scripting and client-side sinks
- Handling blind and out-of-band scenarios using Collaborator
Business Logic and Workflow Testing
- Assessing multi-step workflows and sequence enforcement
- Tampering with price, quantity, and approval parameters
- Exploiting replay attacks, race conditions, and repeat-action abuse
Scanner-Assisted Coverage, Extensions, and AI Assistance
- Configuring crawls and audits for scoped coverage
- Triage issues and validate false positives
- Implementing custom checks using BChecks and extensions
- Utilizing Burp AI and agentic testing while observing data handling limits
Evidence Collection and Audit Documentation
- Collecting request and response evidence with accurate timestamps
- Redacting sensitive data and managing evidence handling
- Mapping findings to OWASP Top 10:2025, WSTG, and CWE standards
- Assessing risk using CVSS v4.0 and audit criteria
Capstone: Comprehensive Web Application Control Assessment
- Performing a scoped assessment on a training application
- Compiling workpapers, findings registers, and closing debriefs
Requirements
- Practical experience in IT auditing and IT security assessments
- Operational knowledge of technology risks, security controls, and network protocols
- Understanding of HTTP/HTTPS protocols and the OWASP framework
- Basic to intermediate proficiency with web security testing tools such as Kali Linux and OWASP ZAP
Target Audience
- Senior and mid-level IT auditors
- Technology risk and security control evaluators
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
