Course Outline
Burp Suite Professional in the IT Audit Process
- The role of the tool across planning, fieldwork, and reporting phases
- Distinguishing manual validation from automated scanning
- Defining rules of engagement and testing authorizations
Workspace Configuration, Scoping, and Traffic Capture
- Setting up proxies, browsers, and TLS
- Establishing scope rules and safeguards for out-of-scope assets
- Managing project files and session handling for evidence preservation
HTTP/HTTPS Traffic Analysis and Application Mapping
- Examining request/response structures, headers, and cookies
- Utilising site maps for content discovery and identifying hidden endpoints
- Reviewing API and JSON traffic patterns
Validating Security Configuration and Transport Controls
- Auditing header, cookie, and CORS configurations
- Assessing TLS settings, HTTP methods, and error disclosure policies
- Comparing configurations against established baselines
Authentication Control Testing
- Evaluating login mechanisms, MFA, and credential policy behaviours
- Testing session tokens, fixation risks, and logout handling
- Identifying weaknesses in token and JWT validation
Authorization and Access Control Testing
- Testing horizontal and vertical privilege escalation across roles
- Identifying insecure direct object references and forced browsing issues
- Documenting role matrix evidence through side-by-side comparisons
Injection, Input Handling, and Out-of-Band Validation
- Confirming injection vulnerabilities without destructive payloads
- Testing for cross-site scripting and client-side sinks
- Investigating blind and out-of-band cases using Collaborator
Business Logic and Workflow Testing
- Assessing multi-step workflows and sequence enforcement
- Identifying tampering in price, quantity, and approval parameters
- Detecting replay attacks, race conditions, and repeat-action abuses
Scanner-Assisted Coverage, Extensions, and AI Assistance
- Configuring crawl and audit settings for scoped coverage
- Triage of issues and validation of false positives
- Developing custom checks using BChecks and extensions
- Utilising Burp AI and agentic testing within data handling limits
Evidence Collection and Audit Documentation
- Capturing request/response evidence with accurate timestamps
- Redacting sensitive data and managing evidence securely
- Mapping findings to OWASP Top 10:2025, WSTG, and CWE frameworks
- Assigning risk ratings using CVSS v4.0 and audit criteria
Capstone: End-to-End Web Application Control Assessment
- Conducting a scoped assessment of a training application
- Preparing workpapers, a findings register, and a closing debrief
Requirements
- Background in IT auditing and IT security assessment.
- Proficient understanding of technology risk, security controls, and network protocols.
- Familiarity with HTTP/HTTPS and the OWASP framework.
- Basic to intermediate proficiency with web security testing tools such as Kali Linux and OWASP ZAP.
Target Audience
- Senior and semi-senior IT auditors.
- Technology risk and security control assessors.
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
