Course Outline
The Role of Burp Suite Professional in the IT Audit Workflow
- The tool’s function across planning, fieldwork, and reporting phases
- Distinguishing between manual verification and automated scanning
- Establishing rules of engagement and testing authorization
Workspace Setup, Scoping, and Traffic Interception
- Configuring the proxy, browser, and TLS settings
- Defining scope rules and implementing out-of-scope protections
- Managing project files and sessions for evidentiary purposes
Analyzing HTTP/HTTPS Traffic and Mapping Applications
- Examining request and response structures, headers, and cookies
- Utilizing site maps, content discovery, and identifying hidden endpoints
- Reviewing API and JSON traffic flows
Verifying Security Configuration and Transport Controls
- Auditing header, cookie, and CORS configurations
- Reviewing TLS settings, HTTP methods, and error disclosure mechanisms
- Benchmarking against established configuration baselines
Testing Authentication Controls
- Evaluating login processes, MFA implementation, and credential policies
- Analyzing session tokens, fixation risks, and logout handling
- Identifying validation weaknesses in tokens and JWTs
Assessing Authorization and Access Controls
- Testing horizontal and vertical privilege escalation across roles
- Detecting insecure direct object references and forced browsing issues
- Documenting role matrix evidence and comparative analysis
Injection, Input Handling, and Out-of-Band Verification
- Confirming injection vulnerabilities using non-destructive payloads
- Testing for cross-site scripting and client-side vulnerabilities
- Handling blind and out-of-band scenarios using Collaborator
Testing Business Logic and Workflows
- Enforcing multi-step workflows and sequence integrity
- Detecting tampering with price, quantity, and approval parameters
- Identifying replay attacks, race conditions, and repeat-action abuse
Scanner-Assisted Coverage, Extensions, and AI Support
- Configuring crawl and audit settings for scoped coverage
- Triage of issues and validation of false positives
- Implementing custom checks via BChecks and extensions
- Leveraging Burp AI and agentic testing within data handling constraints
Evidentiary Collection and Audit Documentation
- Recording request and response evidence with precise timestamps
- Managing sensitive data redaction and evidence handling procedures
- Aligning findings with OWASP Top 10:2025, WSTG, and CWE standards
- Risk assessment using CVSS v4.0 and audit criteria
Capstone Project: Comprehensive Web Application Control Evaluation
- Conducting a scoped assessment of a training application
- Preparing workpapers, maintaining a findings register, and conducting a closing debrief
Requirements
- Background in IT auditing and IT security assessments
- Practical understanding of technology risk, security controls, and network protocols
- Knowledge of HTTP/HTTPS and the OWASP framework
- Basic to intermediate proficiency with web security testing tools such as Kali Linux and OWASP ZAP
Target Audience
- Senior and mid-level IT auditors
- Assessors specializing in technology risk and security controls
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
