---
# System prepended metadata

title: Application Security Training Syllabus
tags: [Syllabus, Application Security]

---

# Application Security Training 課程介紹

[toc]

<br>

## 課程介紹

本課程時數預計約6hr, 適合初階資安工程師或是有軟體工程背景的學員

難度設定在初階到中等之間，受眾相對廣泛

課程中會使用範例來介紹在軟體開發時會遇到的問題點

課程結束後，可了解如何使用資安原則、主流攻擊技巧演練與如何透過安全設計來做防禦。
<br>

## 講師介紹 

Billy (0xbc000)：NYU電腦工程研究所畢業，在加密貨幣產業擔任產品安全工程師。專注在 Application Security, 滲透測試, Secure Design等領域

持有證照包涵以下 
- [OSCP](https://www.credly.com/earner/earned/badge/e3ceddee-13d0-44c8-9138-cc47fb135300)
- [OSEP](https://www.credly.com/earner/earned/badge/33e7fd21-90bc-4080-86e0-1621b2e2fa06)
- [ARTE](https://training.hacktricks.xyz/certificates/d63dc5fa-32cc-4242-850e-e74fb5bd1698)
<br>


## 受眾要求：
- 了解TCP/IP
- 基本程式知識(bash, python, perl)
- 基本Linux知識
<br>

## 課程大綱

### Introduction to Application Security

* What Is Application Security?
* Why Needs Application Security
* Threats In Applications

### SSDLC

* Overview of SSDLC
* Overview of Application Security Testing
* Problems in Real World SSDLC

### Secure Design & Threat Modeling

* Intro To Secure Design
* Confidentiality / Integrity / Availability
* Secure Design Principles
* Threat Modeling
* Secure Code Review Techniques

### Web Application Security

* Intro to Authentication
* Password Reset
* SQL Injection
    * SQL Injection Source Code
* XSS
    * Stored XSS Source Code
* Arbitrary File Upload
    * File Upload Source Code
* Remote Code Execution
    * Command Injection Soucre Code
* LFI / RFI
    * File Inclusion Source Code
* Access Control Issue
* Server-Side Request Forgery (SSRF)
* Race Condition

### Lab

* Burp Suite Intro
* Web Application Attack Lab - DVWA
* Java Code Review 101


