Course Outline
The Role of Burp Suite Professional in the IT Audit Process
- The tool's function across planning, fieldwork, and reporting phases
- Manual verification compared with automated scanning
- Rules of engagement and testing authorization protocols
Workspace Setup, Scoping, and Traffic Acquisition
- Proxy, browser, and TLS configuration
- Defining scope rules and protecting out-of-scope assets
- Managing project files and sessions for evidence preservation
HTTP/HTTPS Traffic Inspection and Application Mapping
- Analyzing request and response structures, headers, and cookies
- Site mapping, content discovery, and identification of hidden endpoints
- Reviewing API and JSON traffic
Verification of Security Configuration and Transport Controls
- Reviewing header, cookie, and CORS configurations
- Assessing TLS settings, HTTP methods, and error disclosure practices
- Benchmarking against agreed-upon configuration baselines
Testing Authentication Controls
- Evaluating login, MFA, and credential policy behaviors
- Assessing session tokens, fixation risks, and logout mechanisms
- Identifying weaknesses in token and JWT validation
Testing Authorization and Access Controls
- Conducting horizontal and vertical privilege tests across roles
- Testing for insecure direct object references and forced browsing
- Documenting role matrix evidence and performing side-by-side comparisons
Injection, Input Processing, and Out-of-Band Verification
- Confirming injection vulnerabilities without using destructive payloads
- Testing for cross-site scripting and client-side sinks
- Handling blind and out-of-band cases using Collaborator
Business Logic and Workflow Testing
- Evaluating multi-step workflows and sequence enforcement
- Testing for tampering with price, quantity, and approval parameters
- Identifying replay attacks, race conditions, and repeat-action abuses
Scanner-Assisted Coverage, Extensions, and AI Support
- Configuring crawls and audits for scoped coverage
- Triage of issues and validation of false positives
- Creating custom checks using BChecks and extensions
- Leveraging Burp AI and agentic testing within data handling limits
Evidence Gathering and Audit Documentation
- Collecting request and response evidence with precise timestamps
- Redacting sensitive data and managing evidence
- Aligning findings with OWASP Top 10:2025, WSTG, and CWE standards
- Assigning risk ratings using CVSS v4.0 and audit criteria
Capstone: Comprehensive Web Application Control Assessment
- Conducting a scoped assessment of a training application
- Preparing workpapers, findings registers, and conducting a closing debrief
Requirements
- Professional experience in IT auditing and IT security assessment
- Operational knowledge of technology risk, security controls, and network protocols
- Familiarity with HTTP/HTTPS and the OWASP framework
- Basic to intermediate proficiency with web security testing tools such as Kali Linux and OWASP ZAP
Target Audience
- Senior and semi-senior IT auditors
- Technology risk and security control assessors
Custom Corporate Training
Training solutions designed exclusively for businesses.
- Customized Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
- Flexible Schedule: Dates and times adapted to your team's agenda.
- Format: Online (live), In-company (at your offices), or Hybrid.
Price per private group, online live training, starting from 3900 € + VAT*
Contact us for an exact quote and to hear our latest promotions
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
