Course Outline
The Role of Burp Suite Professional in the IT Audit Lifecycle
- Application of the tool across planning, fieldwork, and reporting phases
- Distinguishing between manual verification and automated scanning
- Establishing rules of engagement and securing testing authorization
Workspace Setup, Scoping, and Traffic Capture
- Configuring the proxy, browser, and TLS settings
- Defining scope rules and implementing out-of-scope protections
- Managing project files and sessions to preserve audit evidence
HTTP/HTTPS Traffic Analysis and Application Mapping
- Examining request/response structures, headers, and cookies
- Constructing site maps, discovering content, and identifying hidden endpoints
- Analyzing API interactions and JSON data streams
Validation of Security Configuration and Transport Controls
- Reviewing header, cookie, and CORS configurations
- Assessing TLS settings, HTTP methods, and error message disclosure
- Benchmarking findings against established configuration baselines
Testing Authentication Controls
- Evaluating login mechanisms, MFA, and credential policy enforcement
- Inspecting session token management, fixation risks, and logout procedures
- Identifying weaknesses in token and JWT validation
Testing Authorization and Access Controls
- Conducting horizontal and vertical privilege escalation tests across user roles
- Detecting insecure direct object references and forced browsing vulnerabilities
- Documenting role matrices and performing comparative access analyses
Injection, Input Handling, and Out-of-Band Verification
- Confirming injection vulnerabilities using non-destructive payloads
- Testing for cross-site scripting (XSS) and client-side vulnerabilities
- Investigating blind and out-of-band scenarios using Collaborator
Business Logic and Workflow Assessment
- Testing multi-step workflows and enforcing proper sequence execution
- Detecting tampering with price, quantity, and approval parameters
- Identifying replay attacks, race conditions, and unauthorized repeat actions
Scanner-Assisted Coverage, Extensions, and AI Support
- Configuring crawl and audit settings for comprehensive scoped coverage
- Triage of issues and validation of false positives
- Developing custom checks using BChecks and extensions
- Leveraging Burp AI and agentic testing while adhering to data handling constraints
Evidence Collection and Audit Reporting
- Capturing timestamped request and response evidence
- Implementing data redaction and secure evidence handling practices
- Aligning findings with OWASP Top 10:2025, WSTG, and CWE standards
- Assigning risk ratings using CVSS v4.0 and relevant audit criteria
Capstone Project: Comprehensive Web Application Control Assessment
- Executing a scoped assessment on a dedicated training application
- Preparing workpapers, maintaining a findings register, and conducting a final debrief
Requirements
- Professional experience in IT auditing and IT security assessments
- Proficient understanding of technology risk, security controls, and network protocols
- Knowledge of HTTP/HTTPS protocols and the OWASP framework
- Basic to intermediate proficiency with web security testing tools, including Kali Linux and OWASP ZAP
Target Audience
- Senior and semi-senior IT auditors
- Assessors specializing in technology risk and security controls
Testimonials (2)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
Rea Mendez - BAKAWAN Data Anallytics Inc.
Course - OWASP Top 10 2025
I really enjoyed learning about AI attacks and the tools out there to begin practicing and actively using for security testing. I took a lot of knowledge away which I didn't have at the beginning and the course met what I hoped it would be. My favorite part shown from the training was Comet Browser and was amazed at what it could do. Definitely something will be looking into more. Overall it was a great course and enjoyed learning all OWASP GenAI Top 10.
