Course Outline
Role of Burp Suite Professional in the IT Audit Process
- The tool's function across planning, fieldwork, and reporting
- Manual validation versus automated scanning
- Rules of engagement and testing authorization
Workspace Configuration, Scope, and Traffic Capture
- Proxy, browser, and TLS setup
- Scope rules and protection against out-of-scope requests
- Project files and session management for evidence preservation
HTTP/HTTPS Traffic Analysis and Application Mapping
- Request and response structure, headers, and cookies
- Site mapping, content discovery, and identification of hidden endpoints
- Review of API and JSON traffic
Validation of Security Configuration and Transport Controls
- Review of header, cookie, and CORS configurations
- TLS settings, HTTP methods, and error disclosure mechanisms
- Comparison against agreed-upon configuration baselines
Testing Authentication Controls
- Behaviour of login, MFA, and credential policies
- Session token management, fixation, and logout handling
- Weaknesses in token and JWT validation
Testing Authorization and Access Controls
- Horizontal and vertical privilege testing across user roles
- Insecure direct object references and forced browsing scenarios
- Evidence collection for role matrices and side-by-side comparisons
Injection, Input Handling, and Out-of-Band Validation
- Confirming injection vulnerabilities without using destructive payloads
- Testing cross-site scripting and client-side sinks
- Handling blind and out-of-band cases using Collaborator
Testing Business Logic and Workflows
- Enforcement of multi-step workflows and sequences
- Tampering with price, quantity, and approval parameters
- Abuse of replay attacks, race conditions, and repeated actions
Scanner-Assisted Coverage, Extensions, and AI Assistance
- Crawl and audit configuration for scoped coverage
- Triage of issues and validation of false positives
- Creating custom checks using BChecks and extensions
- Utilizing Burp AI and agentic testing with data handling limitations
Evidence Collection and Audit Documentation
- Request and response evidence with timestamps
- Redaction of sensitive data and proper evidence handling
- Mapping findings to OWASP Top 10:2025, WSTG, and CWE
- Risk rating using CVSS v4.0 and audit criteria
Capstone: End-to-End Web Application Control Assessment
- Scoped assessment of a training application
- Creation of workpapers, findings register, and closing debrief
Requirements
- Experience in IT auditing and IT security assessment
- Working knowledge of technology risk, security controls, and network protocols
- Familiarity with HTTP/HTTPS and the OWASP framework
- Basic to intermediate use of web security testing tools such as Kali Linux and OWASP ZAP
Target Audience
- Senior and semi-senior IT auditors
- Technology risk and security control assessors
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
