Course Outline
Role of Burp Suite Professional in the IT Audit Process
- Tool application across planning, fieldwork, and reporting phases
- Distinction between manual validation and automated scanning
- Rules of engagement and testing authorization protocols
Workspace Configuration, Scope Definition, and Traffic Capture
- Setup of proxy, browser, and TLS
- Establishing scope rules and out-of-scope protections
- Management of project files and session handling for evidence preservation
HTTP/HTTPS Traffic Analysis and Application Mapping
- Analysis of request and response structures, headers, and cookies
- Review of site maps, content discovery, and hidden endpoints
- Inspection of API and JSON traffic
Verification of Security Configuration and Transport Controls
- Review of header, cookie, and CORS configurations
- Assessment of TLS settings, HTTP methods, and error disclosure
- Comparison against established configuration baselines
Authentication Control Testing
- Evaluation of login, MFA, and credential policy behavior
- Testing session tokens, fixation, and logout handling
- Identification of token and JWT validation weaknesses
Authorization and Access Control Testing
- Horizontal and vertical privilege testing across various roles
- Detection of insecure direct object references and forced browsing
- Documentation of role matrix evidence and side-by-side comparisons
Injection, Input Handling, and Out-of-Band Verification
- Confirmation of injections without deploying destructive payloads
- Testing for cross-site scripting and client-side sinks
- Handling blind and out-of-band cases using Collaborator
Business Logic and Workflow Testing
- Validation of multi-step workflows and sequence enforcement
- Detection of price, quantity, and approval parameter tampering
- Identification of replay, race conditions, and repeat-action abuses
Scanner-Assisted Coverage, Extensions, and AI Assistance
- Configuration of crawl and audit for scoped coverage
- Triage of issues and validation of false positives
- Implementation of custom checks using BChecks and extensions
- Utilization of Burp AI and agentic testing with data handling constraints
Evidence Collection and Audit Documentation
- Capture of request and response evidence with timestamps
- Redaction of sensitive data and proper evidence handling
- Mapping findings to OWASP Top 10:2025, WSTG, and CWE
- Risk assessment using CVSS v4.0 and audit criteria
Capstone: Comprehensive Web Application Control Assessment
- Execution of a scoped assessment on a training application
- Preparation of workpapers, findings register, and closing debrief
Requirements
- Experience in IT auditing and IT security assessment
- Proficient knowledge of technology risk, security controls, and network protocols
- Familiarity with HTTP/HTTPS and the OWASP framework
- Basic to intermediate proficiency with web security testing tools such as Kali Linux and OWASP ZAP
Target Audience
- Senior and semi-senior IT auditors
- Technology risk and security control assessors
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
