Course Outline
The Role of Burp Suite Professional in IT Auditing
- The tool’s function across planning, fieldwork, and reporting phases.
- Manual verification versus automated scanning strategies.
- Rules of engagement and testing authorization protocols.
Workspace Setup, Scoping, and Traffic Capture
- Configuring the proxy, browser, and TLS settings.
- Defining scope rules and implementing out-of-scope protections.
- Managing project files and sessions for evidence preservation.
HTTP/HTTPS Traffic Analysis and Application Mapping
- Analyzing request and response structures, headers, and cookies.
- Utilizing site maps, content discovery, and hidden endpoint identification.
- Reviewing API and JSON traffic patterns.
Validating Security Configurations and Transport Controls
- Auditing header, cookie, and CORS configurations.
- Reviewing TLS settings, HTTP methods, and error disclosure practices.
- Comparing findings against established configuration baselines.
Testing Authentication Controls
- Assessing login mechanisms, MFA, and credential policy behavior.
- Evaluating session token management, fixation risks, and logout processes.
- Identifying validation weaknesses in tokens and JWTs.
Testing Authorization and Access Controls
- Performing horizontal and vertical privilege testing across user roles.
- Testing for insecure direct object references and forced browsing.
- Generating role matrix evidence and conducting side-by-side comparisons.
Injection, Input Handling, and Out-of-Band Verification
- Confirming injection vulnerabilities without using destructive payloads.
- Testing for cross-site scripting and client-side vulnerabilities.
- Handling blind and out-of-band cases using Collaborator.
Business Logic and Workflow Assessment
- Evaluating multi-step workflows and sequence enforcement.
- Testing for tampering with price, quantity, and approval parameters.
- Identifying replay attacks, race conditions, and repeat-action abuses.
Scanner-Assisted Coverage, Extensions, and AI Support
- Configuring crawl and audit settings for scoped coverage.
- Triage of issues and validation of false positives.
- Implementing custom checks using BChecks and extensions.
- Utilizing Burp AI and agentic testing with appropriate data handling limits.
Evidence Collection and Audit Documentation
- Capturing request and response evidence with accurate timestamps.
- Redacting sensitive data and managing evidence handling procedures.
- Mapping findings to OWASP Top 10:2025, WSTG, and CWE standards.
- Assigning risk ratings using CVSS v4.0 and audit criteria.
Capstone: Comprehensive Web Application Control Assessment
- Conducting a scoped assessment of a designated training application.
- Compiling workpapers, findings registers, and conducting a closing debrief.
Requirements
- Practical experience in IT auditing and IT security assessments.
- Operational knowledge of technology risks, security controls, and network protocols.
- Proficiency with HTTP/HTTPS protocols and the OWASP framework.
- Basic to intermediate experience with web security testing tools, including Kali Linux and OWASP ZAP.
Target Audience
- Senior and semi-senior IT auditors.
- Technology risk and security control assessors.
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
