Written as a followup to Modern Webapp Pentesting, this course builds on the fundamentals and gives you experience with how they apply to current problems in web applications.

A very hands-on course, the material is organized around key technologies and concepts like authentication and authorization, understanding in-browser defenses so you can devise ways to bypass them, and learning just enough about web development to see where real developers are likely to make mistakes or rely too much on unstated assumptions.

This course doesn’t worry about where a student falls on the imaginary scale of beginner to expert but instead focuses on finding and exploiting the kinds of issues found in real webapps today.

Wild West Hackin’ Fest (Oct 8th – Oct 9th, 2024) – Deadwood, SD

October 8th – 8:30 AM to 5:00 PM MDT
October 9th – 8:30 AM to 5:00 PM MDT

Wild West Hackin’ Fest at Mile High (Feb 4th – Feb 5th, 2025) – Denver, CO

February 4th – 8:30 AM to 5:00 PM MDT
February 5th – 8:30 AM to 5:00 PM MDT

Key Takeaways

A reliable methodology for testing today’s webapps
Hands-on experience with the kinds of defects that modern webapps actually have
Tips and Tricks for effective reporting so the issues you find can be fixed

Who Should Take This Course

Motivated Beginners: the course begins with a dive into the protocols and standards that every webapp relies on. With this often overlooked anchor in the fundamentals, you will more easily see how abusing those things can lead to exploits
Experienced Testers: with the shared understanding of the fundamental concepts, the middle section of the course moves on to show some of the more common ways that weaknesses appear in real applications. The middle section of the course is a lot of hands-on practice time, with lab options for all skill levels. If you know some exploits, but don’t know deeply how and why they work, this section will make you a more confident and flexible tester
Everyone: the course wraps up with a deep dive into JSON Web Tokens (JWTs) and an introduction to Web Sockets. After investigating the fundamentals of how those things work, tied neatly to the anchors we started with, you will find a clear and repeatable way to quickly learn about unfamiliar technologies so that you won’t be caught short the next time you see something new for the first time
If you already test webapps routinely, you may appreciate the focus on the fundamentals, an easy-to-follow testing methodology, and the time spent thinking about how best to report what you find so you’re more likely to drive improvements, earn that bug bounty, or get hired again for a future test

Audience Skill Level

Motivated Beginners: the course begins with a brief review of protocols and tools so we have a shared mental framework to process the more advanced topics that come later
Experienced Testers: the majority of the course addresses features and technologies that are not so much “advanced topics” that rely heavily on deep understanding of arcane topics as “newer things that nobody talks about attacking”
If you test webapps exclusively, all day every day, you may still appreciate the time spent on focused practice, methodology, and reporting. Anyone else will also find some new things they can take back to work or bounty-hunting right away

What Each Student Should Bring

Curiosity and tenacity
A laptop with the features described above
OR one with Docker pre-installed (the course does not include any Docker instruction, so do this only if you’re already comfortable troubleshooting your own Docker issues)
At least 10GB available diskspace
Current Firefox web browser

What Each Student Will Be Provided With

Slide deck and links to all the material and tools needed with instructions
Virtual machine with all the necessary tools and targets for the course
Contact information for the instructor and a 6-week window of direct one-on-one access in case you have questions after the class is over

Stable Internet access
x86 architecture CPU clocked at 2 GHz or higher that is capable of nested virtualization
(Apple Silicon is currently not supported)
A computer with at least 8 GB of RAM. 16 GB is recommended
VMWare Workstation or VMWare Fusion
(VirtualBox and other VM software is not supported)
Windows 10/11, MacOSX+, or a currently supported Linux Distribution
Full Administrator/root access to your computer or laptop

This class is available for training at both WWHF Deadwood 2024 and
WWHF Mile High 2025. For more information about our conferences, visit
Wild West Hackin’ Fest!

See Conferences Here