Course Outline
The Role of Burp Suite Professional in the IT Audit Process
- The tool's function across planning, fieldwork, and reporting phases
- Distinguishing manual verification from automated scanning
- Establishing rules of engagement and testing authorization
Workspace Setup, Scoping, and Traffic Capture
- Configuring the proxy, browser, and TLS settings
- Defining scope rules and protecting out-of-scope assets
- Managing project files and sessions for evidence preservation
HTTP/HTTPS Traffic Analysis and Application Mapping
- Analyzing request and response structures, including headers and cookies
- Utilizing the site map for content discovery and identifying hidden endpoints
- Reviewing API and JSON traffic patterns
Validation of Security Configuration and Transport Controls
- Assessing header, cookie, and CORS configurations
- Examining TLS settings, HTTP methods, and error disclosure levels
- Benchmarking against agreed-upon configuration baselines
Testing Authentication Controls
- Evaluating login mechanisms, MFA, and credential policy enforcement
- Testing session token management, fixation risks, and logout procedures
- Identifying weaknesses in token and JWT validation
Testing Authorization and Access Controls
- Performing horizontal and vertical privilege tests across different roles
- Detecting insecure direct object references and forced browsing vulnerabilities
- Generating role matrix evidence through side-by-side comparisons
Injection, Input Handling, and Out-of-Band Verification
- Confirming injection vulnerabilities without deploying destructive payloads
- Testing for Cross-Site Scripting and client-side sink vulnerabilities
- Investigating blind and out-of-band cases using Collaborator
Business Logic and Workflow Testing
- Assessing multi-step workflows and sequence enforcement
- Testing for tampering in price, quantity, and approval parameters
- Identifying replay attacks, race conditions, and abuse of repeated actions
Scanner-Assisted Coverage, Extensions, and AI Assistance
- Configuring crawl and audit settings for comprehensive scoped coverage
- Triaging issues and validating false positives
- Developing custom checks using BChecks and extensions
- Leveraging Burp AI and agentic testing within data handling constraints
Evidence Collection and Audit Documentation
- Capturing request and response evidence with precise timestamps
- Redacting sensitive data and managing evidence appropriately
- Aligning findings with OWASP Top 10:2025, WSTG, and CWE standards
- Risk rating using CVSS v4.0 and audit criteria
Capstone: End-to-End Web Application Control Assessment
- Conducting a scoped assessment of a training application
- Preparing workpapers, a findings register, and a closing debrief
Requirements
- Practical experience in IT auditing and IT security evaluations
- Proficiency in technology risk management, security controls, and network protocols
- Knowledge of HTTP/HTTPS protocols and the OWASP framework
- Familiarity with web security testing tools, such as Kali Linux and OWASP ZAP, at a basic to intermediate level
Target Audience
- Senior and semi-senior IT auditors
- Specialists in technology risk and security control assessment
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
