Course Outline
The Role of Burp Suite Professional in IT Auditing
- The tool's function throughout planning, fieldwork, and reporting phases
- Differentiating manual validation from automated scanning
- Adhering to engagement rules and testing authorizations
Configuring the Workspace, Defining Scope, and Capturing Traffic
- Setting up the proxy, browser, and TLS parameters
- Establishing scope rules and protecting out-of-scope assets
- Managing project files and sessions to ensure evidence integrity
Analyzing HTTP/HTTPS Traffic and Mapping Applications
- Examining request and response structures, including headers and cookies
- Constructing site maps, discovering content, and identifying hidden endpoints
- Reviewing API and JSON traffic flows
Validating Security Configuration and Transport Controls
- Auditing header, cookie, and CORS configurations
- Checking TLS settings, HTTP methods, and error disclosure levels
- Comparing findings against established configuration baselines
Testing Authentication Controls
- Assessing login, MFA, and credential policy behaviors
- Evaluating session tokens, fixation risks, and logout processes
- Identifying vulnerabilities in token and JWT validation
Testing Authorization and Access Controls
- Conducting horizontal and vertical privilege tests across user roles
- Detecting insecure direct object references and forced browsing attempts
- Documenting role matrix evidence through side-by-side comparisons
Injection, Input Handling, and Out-of-Band Verification
- Confirming injection flaws without using destructive payloads
- Testing for cross-site scripting and client-side vulnerabilities
- Investigating blind and out-of-band cases using Collaborator
Testing Business Logic and Workflows
- Enforcing multi-step workflow sequences and integrity
- Detecting tampering with price, quantity, and approval parameters
- Identifying abuse of replay attacks, race conditions, and repeated actions
Scanner-Assisted Coverage, Extensions, and AI Support
- Configuring crawl and audit settings for targeted coverage
- Triage of issues and validation of false positives
- Developing custom checks using BChecks and extensions
- Leveraging Burp AI and agentic testing within defined data handling limits
Collecting Evidence and Documenting for Audits
- Recording request and response evidence with accurate timestamps
- Redacting sensitive data and managing evidence appropriately
- Aligning findings with OWASP Top 10:2025, WSTG, and CWE standards
- Assessing risk using CVSS v4.0 and established audit criteria
Capstone Project: Comprehensive Web Application Control Assessment
- Executing a scoped assessment on a dedicated training application
- Compiling workpapers, a findings register, and a closing debrief
Requirements
- Practical experience in IT auditing and IT security assessments
- Proficiency in technology risk management, security controls, and network protocols
- Working knowledge of HTTP/HTTPS and the OWASP framework
- Familiarity with basic to intermediate web security testing tools, such as Kali Linux and OWASP ZAP
Target Audience
- Senior and mid-level IT auditors
- Specialists in technology risk and security control assessment
Testimonials (1)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
