Web Application Penetration Testing with Burp Suite

<p>Follow Ndidi Okoro, a newly hired application security engineer at Wrenhouse Digital, as she runs her first end-to-end web application penetration test against ClaimPort, an insurance claims portal, ahead of a client's contract renewal. Across five hands-on lessons she configures Burp Suite as an intercepting proxy with a proper scope and trusted CA certificate, manually maps the app's attack surface using the site map and passive scanner, uncovers an IDOR and a SQL injection in the claims search using Repeater and sqlmap, demonstrates stored XSS and a CSRF password-change exploit, and scales up the IDOR proof with Burp Intruder before writing a findings report a compliance reviewer and an engineering lead can both use.</p>

Tools: burp suite, sqlmap, web application security, penetration testing