Course Outline
The Role of Burp Suite Professional in IT Audit Processes
- The tool’s application across planning, fieldwork, and reporting phases
- Distinguishing manual verification from automated scanning
- Establishing rules of engagement and testing authorizations
Configuring the Workspace, Defining Scope, and Capturing Traffic
- Setting up proxies, browsers, and TLS
- Defining scope rules and implementing out-of-scope protections
- Managing project files and sessions for evidence preservation
Analyzing HTTP/HTTPS Traffic and Mapping Applications
- Examining request and response structures, headers, and cookies
- Utilizing site maps, content discovery, and identifying hidden endpoints
- Reviewing API and JSON traffic
Validating Security Configurations and Transport Controls
- Reviewing header, cookie, and CORS configurations
- Assessing TLS settings, HTTP methods, and error disclosures
- Benchmarking findings against agreed configuration baselines
Testing Authentication Controls
- Observing login, MFA, and credential policy behaviors
- Analyzing session tokens, fixation risks, and logout mechanisms
- Identifying weaknesses in token and JWT validation
Testing Authorization and Access Controls
- Conducting horizontal and vertical privilege tests across roles
- Detecting insecure direct object references and forced browsing vulnerabilities
- Documenting role matrix evidence and side-by-side comparisons
Validating Injection, Input Handling, and Out-of-Band Scenarios
- Confirming injection vulnerabilities without using destructive payloads
- Testing cross-site scripting and client-side sinks
- Investigating blind and out-of-band cases using Collaborator
Testing Business Logic and Workflows
- Verifying multi-step workflow and sequence enforcement
- Detecting tampering with price, quantity, and approval parameters
- Identifying replay attacks, race conditions, and repeat-action abuses
Leveraging Scanner-Assisted Coverage, Extensions, and AI Support
- Configuring crawl and audit functions for scoped coverage
- Triage issues and validate false positives
- Implementing custom checks using BChecks and extensions
- Utilizing Burp AI and agentic testing while adhering to data handling limits
Collecting Evidence and Drafting Audit Documentation
- Capturing request and response evidence with timestamps
- Redacting sensitive data and managing evidence handling
- Aligning findings with OWASP Top 10:2025, WSTG, and CWE
- Assigning risk ratings using CVSS v4.0 and audit criteria
Capstone: Comprehensive Web Application Control Assessment
- Executing a scoped assessment on a training application
- Preparing workpapers, a findings register, and a closing debrief
Requirements
- Background in IT auditing and IT security evaluations
- Working understanding of technology risk, security controls, and network protocols
- Knowledge of HTTP/HTTPS and the OWASP framework
- Basic to intermediate proficiency with web security testing tools, including Kali Linux and OWASP ZAP
Target Audience
- Senior and semi-senior IT auditors
- Technology risk and security control assessors
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
