Course Outline
Application of Burp Suite Professional in Government IT Audit Procedures
- Integration of tool capabilities within planning, fieldwork, and reporting phases
- Distinguishing between manual verification and automated scanning methods
- Compliance with rules of engagement and authorization protocols for government systems
Workspace Configuration, Scope Definition, and Traffic Acquisition
- Establishing proxy, browser, and TLS configurations
- Defining scope boundaries and implementing protections for out-of-scope assets
- Managing project files and session data to ensure evidentiary integrity
HTTP/HTTPS Traffic Examination and Application Architecture Mapping
- Analyzing request and response structures, including headers and cookies
- Identifying site architecture, content, and concealed endpoints
- Reviewing API interactions and JSON data exchanges
Verification of Security Configuration and Transport Layer Controls
- Auditing header, cookie, and CORS configuration settings
- Evaluating TLS parameters, HTTP method usage, and error message disclosure
- Benchmarking observations against established configuration baselines
Testing of Authentication Mechanisms
- Assessing login processes, MFA enforcement, and credential policy adherence
- Examining session token management, fixation risks, and logout procedures
- Identifying weaknesses in token and JWT validation for government applications
Assessment of Authorization and Access Control Frameworks
- Testing horizontal and vertical privilege escalation across defined roles
- Detecting insecure direct object references and unauthorized browsing attempts
- Documenting role-based access matrix evidence and comparative analysis
Validation of Injection Vulnerabilities, Input Handling, and Out-of-Band Detection
- Confirming injection risks without employing destructive payloads
- Testing for cross-site scripting and client-side vulnerabilities
- Addressing blind and out-of-band scenarios using Collaborator tools
Business Logic and Workflow Integrity Testing
- Verifying multi-step workflow sequences and enforcement mechanisms
- Testing for parameter tampering involving price, quantity, and approval states
- Identifying replay attacks, race conditions, and repeated action abuse
Scanner-Aided Coverage, Extension Integration, and AI Assistance
- Configuring crawl and audit parameters for comprehensive scoped coverage
- Triage of issues and validation of potential false positives
- Developing custom checks using BChecks and relevant extensions
- Utilizing Burp AI and agentic testing features within data handling constraints for government contexts
Evidence Gathering and Audit Documentation Standards
- Compiling request and response evidence with precise timestamps
- Applying redaction of sensitive data and proper evidence handling procedures
- Correlating findings with OWASP Top 10:2025, WSTG, and CWE standards
- Assigning risk ratings using CVSS v4.0 in alignment with audit criteria
Capstone: Comprehensive Web Application Control Assessment
- Conducting a scoped assessment of a designated training application
- Preparing workpapers, findings registers, and concluding debriefs for government stakeholders
Requirements
- Professional experience in IT auditing and IT security assessment
- Working knowledge of technology risk, security controls, and network protocols
- Familiarity with HTTP/HTTPS standards and the OWASP framework
- Basic to intermediate proficiency with web security testing tools, including Kali Linux and OWASP ZAP
Target Audience
- Senior and semi-senior IT auditors
- Technology risk and security control assessors
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
