>> Hello everyone and welcome
>> to the Cybrary On-demand OWASP,
>> Top 10 application security risks of 2021.
Now this course is being rolled out
>> just a few weeks after OWASP has released
>> the latest version of the OWASP Top 10.
>> You're going to get to see
>> some cutting edge stuff here.
>> Our learning objectives are to explain
why someone would take this course.
Describe the target audience, you.
List of prerequisites
>> that you should have to take this course.
>> Describe the course goals as well as our syllabus,
and get to know me Clint Kehr, your instructor.
Why should I take this course?
You should take this course
>> because OWASP has completely
>> revamped the OWASP Top 10 from the 2017 version.
We're going to get to understand together
>> why it's important to understand
>> the newest and latest version
of the OWASP Top 10 in 2021.
This course is modular by design,
we're going to be rolling out courses individually.
You can either take courses individually
>> or at the end when we're done rolling out,
>> all courses all OWASP Top 10 security risks.
You can take them all at once.
But it's nice to be able to just maybe in your day job,
you want to know more about security misconfiguration
>> so you can go ahead
>> and take that specific course when it comes out.
>> It's also important to understand the OWASP Top 10
>> if you're going to be in web application security
>> from both defensive and offensive perspectives
>> it's important to understand the OS Top 10.
These are frequently questions
you'll get asked in job interviews.
Who am I? My name is Clint Kehr
>> and I am your instructor.
>> I'm in a few other courses on Cybrary,
>> but I'm an ethical hacker.
I don't think hacker is a negative name.
I think hacker is a badge of honor,
which I wear proudly.
A hacker is somebody
>> who's just interested in technology
>> and they got a bad rap along the way.
>> As you can see, there's me
doing a presentation on the dark web
>> and I had a guy in a hoodie
>> which you'll probably thinks a hacker,
>> but I would call that a cyber-criminal.
I have a Masters of Science in
Information Technology from Carnegie Mellon University,
and I have a bunch of certifications here.
I have both offensive as you can see, OSCP,
I have my GPEN, GWAPT from Jack Sands.
I also have some e-learning certifications,
>> eCPPT, eWPT.
>> I have some CompTIA certifications,
PenTest plus Security Plus,
and some EC council certifications
>> with my CEH and CHFI.
>> I really like to learn
>> the different certification bodies
>> and how they test people in pentesting
>> or forensics or things like that.
That's why I take all these courses
and get all these certifications because
I'm genuinely interested about the subject matter.
I wasn't originally in cybersecurity.
I was a police officer,
then became a federal agent.
During my journey as a federal agent,
I got more involved in cybersecurity,
in dark web investigations,
which led me to become more involved
>> in technology and understand technology more.
>> But I really liked the offensive side of cybersecurity
>> and decided to leave law enforcement for pen-testing.
>> Now I am a pentester
>> at a financial services institution
>> where I'm a manager on the pentest team
>> and have a bunch of pentesters
>> that I actually get to do hands-on pentesting with.
>> Here's my contact information
>> if you want to reach me on LinkedIn or by email.
>> Who is this course intended for?
It's for anyone who's interested in application,
security, and pentesting.
As you can tell from my background,
I am more on the offensive side and the defensive side.
This course will probably have
>> more of an offense or twist to it.
>> We're going to be exploiting
web application vulnerabilities.
This is suited for intermediate
cybersecurity professionals.
As I talked about for the 2021 version
>> of the OWASP Top 10,
>> OWASP has really changed things around.
We do see injection
>> which used to be number one in 2017,
>> but it's moved in the number 3 slot.
We're going to be talking a lot more
about the changes that OWASP has done.
But if you looked at the previous
>> versions of the top 10 from 2013-2017,
>> OWASP has really changed things around.
As you can see number 10 here is
a specific vulnerability, server-side request forgery.
Now you may be looking for other specific things
>> like cross-site scripting or xxe
>> if you're familiar with,
>> again, the 2017 version,
>> that's mixed in here in other categories,
stick with me through this
and I will tell you where they've ended up.
Our course goals are to identify
>> and explain the OWASP Top 10
>> to enumerate and exploit the vulnerability.
>> There's going to be a bunch of hands-on labs with
every single course will have a hands-on lab for you
to get familiarization with these vulnerabilities,
and also, it's not just the fact
>> that you get to do the fun stuff and hack things.
>> You also have to provide guidance to developers,
to CSOs, to our defenders
to explain to them how
to remediate these vulnerabilities.
Your prerequisites is you should have
a basic understanding of how web applications work,
how browsers work
>> how the client interacts with the server.
>> You should know how requests work,
different types of requests get,
GET requests, post requests, things like that.
Just a basic understanding of that knowledge that
the technology is in programming languages
used in web applications.
Typically, when we hack things,
you'll see applications written in PHP.
There's a whole bunch of other programming languages
out there that web applications are built with.
There's some newer ones that are out there.
If you're familiar with Python,
maybe you've run a flask server before.
Some basic understanding,
>> again of how web applications are written
>> and how they work.
>> Basic concepts of browsers,
if you try to exploit a vulnerability,
it might work with Firefox,
whereas it might not work with Chrome.
You need to understand that using different browsers,
you can have different client-side attacks
work or not work depending on
>> what browser you're using
>> and a foundational knowledge of web
>> application hacking using intercepting proxies.
Now we have a module
>> or section on using intercepting proxies.
>> But going into this course,
you should really have some understanding of
how things like burp or ZAP work.
We do have a syllabus for this course.
It maps to the OWASP Top 10.
Of course, we want start with number 1,
broken access control and we're starting with
an introduction to all this to explain
>> what has changed from OWASP 2017
>> or top 10, 2017 to 2021.
>> We'll end with Module 11,
which is server-side request forgery.
The course material.
>> You'll have a syllabus, we'll have labs.
>> You'll have some multiple-choice questions
that you have to answer.
We'll talk about some case studies
to illustrate these vulnerabilities.
We'll have some links and references along the way.
In summary, you should now understand
why you should take this course.
The target audience for this course,
prerequisites you should have,
our course goals in the syllabus,
and you should know a little bit more about me,
Clint Kehr, your instructor.
With that, let's get started.