Close
Contact Us info@learnquest.com

??WelcomeName??
??WelcomeName??
« Important Announcement » Contact Us 877-206-0106 | USA Flag
Close
Close
Close
photo

Thank you for your interest in LearnQuest.

Your request is being processed and LearnQuest or a LearnQuest-Authorized Training Provider will be in touch with you shortly.

photo

Thank you for your interest in Private Training.

We look forward to helping you develop the perfect training solution to help you meet your company's goals.

For immediate assistance, speak with one of our representatives using the chat module below. Otherwise, LearnQuest or a LearnQuest-Authorized Training Provider will be in touch with you shortly.

Close
photo

Thank you for your interest in LearnQuest!

Now, you will be able to stay up-to-date on our latest course offerings, promotions, and training discounts. Watch your inbox for upcoming special offers.

title

Date: xxx

Location: xxx

Time: xxx

Price: xxx

Please take a moment to fill out this form. We will get back to you as soon as possible.

All fields marked with an asterisk (*) are mandatory.

Java EE Secure Coding Camp | Attacking and Securing Java EE Web Applications

Price
2,800 USD
4 Days
TT8320-J
Classroom Training, Online Training
Open Source

AWS Training Pass

Take advantage of flexible training options with the AWS Training Pass and get Authorized AWS Training for a full year.

Learn More

Prices reflect a 22.5% discount for IBM employees (wherever applicable).
Prices reflect a 24% discount for Kyndryl employees (wherever applicable).
Prices reflect the Accenture employee discount.
Prices shown are the special AWS Partner Prices.
Prices reflect the Capgemini employee discount.
Prices reflect the UPS employee discount.
Prices reflect the ??democompanyname?? employee discount.
GSA Private/Onsite Price: ??gsa-private-price??
For GSA pricing, please go to GSA Advantage.
 

Class Schedule

Delivery Formats

Sort results

Filter Classes

Guaranteed to Run

Modality

Location

Language

Date

  • Date: 6-Jan-2025 to 9-Jan-2025
    Time: 9AM - 5PM US Eastern
    Location: Virtual
    Language: English
    Delivered by: LearnQuest
    Price: 2,800 USD
  • Date: 31-Mar-2025 to 3-Apr-2025
    Time: 9AM - 5PM US Eastern
    Location: Virtual
    Language: English
    Delivered by: LearnQuest
    Price: 2,800 USD
  • Date: 12-May-2025 to 15-May-2025
    Time: 9AM - 5PM US Eastern
    Location: Virtual
    Language: English
    Delivered by: LearnQuest
    Price: 2,800 USD
  • Date: 23-Jun-2025 to 26-Jun-2025
    Time: 9AM - 5PM US Eastern
    Location: Virtual
    Language: English
    Delivered by: LearnQuest
    Price: 2,800 USD
View Global Schedule

Course Description

Overview

Attacking and Securing Java EE Web Applications is a lab-intensive, hands-on Java EE security training course that provides a unique coverage of Java application security. In this course, students begin with penetration testing, hunting for bugs in Java web applications. They then thoroughly examine best practices for defensively coding web applications, covering all the OWASP Top Ten as well as several additional prominent vulnerabilities (such as file uploads, CSRF and direct object references). Students will repeatedly attack and then defend various assets associated with fully functional web applications and services. This hands-on approach drives home the mechanics of how to secure JEE web applications in the most practical of terms.

Students will leave the course armed with the skills required to recognize actual and potential software vulnerabilities and implement defenses for those vulnerabilities. This course begins by developing the skills required to fingerprint a web application and then scan it for vulnerabilities and bugs. Practical labs using current tools and techniques provide students with the experience needed to begin testing their own applications. Students also gain a deeper understanding of how attackers probe applications to understand the runtime environment as well as find potential weaknesses. This course the introduces developers to the most common security vulnerabilities faced by web applications today. Each vulnerability is examined from a Java/JEE perspective through a process of describing the threat and attack mechanisms, recognizing associated vulnerabilities, and, finally, designing, implementing, and testing effective defenses.

Practical labs reinforce these concepts with real vulnerabilities and attacks. Students are then challenged to design and implement the layered defenses they will need in defending their own applications. There is an emphasis on the underlying vulnerability patterns since the technologies, use cases, and methods of attack as constantly changing. The patterns remain the same through all the change and flux.
 

Objectives

Upon completion of this course, students will be able to:
  • Ensure that any bug hunting is performed in a safe and appropriate manner
  • Identify defect/bug reporting mechanisms within their organizations
  • Work with specific tools for targeted vulnerabilities
  • Avoid common mistakes that are made in bug hunting and vulnerability testing
  • Understand the concepts and terminology behind defensive, secure coding including the phases and goals of a typical exploit
  • Develop an appreciation for the need and value of a multilayered defense in depth
  • Understand potential sources for untrusted data
  • Understand the consequences for not properly handling untrusted data such as denial of service, cross-site scripting, and injections
  • To test web applications with various attack techniques to determine the existence of and effectiveness of layered defenses
  • Prevent and defend the many potential vulnerabilities associated with untrusted data
  • Understand the vulnerabilities of associated with authentication and authorization
  • Detect, attack, and implement defenses for authentication and authorization functionality and services
  • Understand the dangers and mechanisms behind Cross-Site Scripting (XSS) and Injection attacks
  • Detect, attack, and implement defenses against XSS and Injection attacks
  • Understand the risks associated with XML processing, file uploads, and server-side interpreters and how to best eliminate or mitigate those risks
  • Understand techniques and measures that can used to harden web and application servers as well as other components in your infrastructure

Audience

This is an intermediate -level programming course, designed for experienced Java developers who wish to get up and running on developing well defended software applications.
 

Prerequisites

    Familiarity with Java and Java EE is required and real world programming experience is highly recommended. Ideally students should have approximately 6 months to a year of Java and JEE working knowledge. Students should have basic development skills and a working knowledge in the following topics, or attend these courses as a pre-requisite: TT5102 Java EE Web Application Development Essentials
     

Topics

Bug Hunting Foundation
  • Why Hunt Bugs?
    • Security and Insecurity
    • Dangerous Assumptions
    • Attack Vectors
    • Lab: Case Study in Failure
  • Safe and Appropriate Bug Hunting/Hacking
    • Working Ethically
    • Respecting Privacy
    • Bug/Defect Notification
    • Bug Bounty Programs
Moving Forward From Hunting Bugs
  • Removing Bugs
    • Open Web Application Security Project (OWASP)
    • OWASP Top Ten Overview
    • Web Application Security Consortium
    • CERT Secure Coding Standards
    • Bug Hunting Mistakes to Avoid
    • Tools and Resources
Foundation for Securing Web Applications
  • Principles of Information Security
    • Security Is a Lifecycle Issue
    • Minimize Attack Surface Area
    • Layers of Defense: Tenacious D
    • Compartmentalize
    • Consider All Application States
    • Do NOT Trust the Untrusted
    • Tutorial: Working with Eclipse (JEE Version) and Apache TomEE 7x
    • Tutorial: Working with the HSQL Database
    • Lab: Case Study Setup and Review
Bug Stomping 101
  • Unvalidated Data
    • Buffer Overflows
    • Integer Arithmetic Vulnerabilities
    • Unvalidated Data: Crossing Trust Boundaries
    • Defending Trust Boundaries
    • Whitelisting vs Blacklisting
    • Lab: Defending Trust Boundaries
  • A1: Injection
    • Injection Flaws
    • SQL Injection Attacks Evolve
    • Drill Down on Stored Procedures
    • Other Forms of Injection
    • Minimizing Injection Flaws
    • Lab: Defending Against SQL Injection
  • A2: Broken Authentication
    • Quality and Protection of Authentication Data
    • Handling Passwords on Server Side
    • SessionID Risk Reduction
    • HttpOnly and Security Headers
    • Lab: Defending Authentication
  • A3: Sensitive Data Exposure
    • Protecting Data Can Mitigate Impact
    • In-Memory Data Handling
    • Secure Pipes
    • Failures in TLS/SSL Framework
    • Lab: Defending Sensitive Data
  • A4: XML External Entities (XXE)
    • XML Parser Coercion
    • XML Attacks: Structure
    • XML Attacks: Injection
2023 Top 20 Training Industry Company - IT Training

Need Help?

Call us at 877-206-0106 or e-mail us at info@learnquest.com

Personalized Solutions

Need a personalized solution for your Training? Contact us, and one of our training advisors will help you find the best solution.

Contact Us

Need Help?

Do you have a question about the courses, instruction, or materials covered? Do you need help finding which course is best for you? We are here to help!

Talk to us

Cybersecurity Awareness Month 2024

Get Ahead of Online Threats with 20% Off Security Training.

Use SECURITY20 at checkout. Valid through October 31, 2024.

Browse Training Courses

IBM TechXchange Conference 2024

October 21-24 | Mandalay Bay, Las Vegas

Join us for four action-packed days to immerse yourself in innovation and learning. Gain practical skills in Generative AI, harness IBM technology, and engage with tech industry experts.

Self-Paced Training Info

Learn at your own pace with anytime, anywhere training

  • Same in-demand topics as instructor-led public and private classes.
  • Standalone learning or supplemental reinforcement.
  • e-Learning content varies by course and technology.
  • View the Self-Paced version of this outline and what is included in the SPVC course.
  • Learn more about e-Learning

Course Added To Shopping Cart

bla

bla

bla

bla

bla

bla

Self-Paced Training Terms & Conditions

??spvc-wbt-warning??

Exam Terms & Conditions

??exam-warning??
??group-training-form-area??
??how-can-we-help-you-area??
??personalized-form-area??
??request-quote-area??

Sorry, there are no classes that meet your criteria.

Please contact us to schedule a class.
Close

self-paced
STOP! Before You Leave

Save 0% on this course!

Take advantage of our online-only offer & save 0% on any course !

Promo Code skip0 will be applied to your registration

Close
Nothing yet
here's the message from the cart

To view the cart, you can click "View Cart" on the right side of the heading on each page
Add to cart clicker.

Purchase Information

??elearning-coursenumber?? ??coursename??
View Cart

title

Date: xxx

Location: xxx

Time: xxx

Price: xxx

Please take a moment to fill out this form. We will get back to you as soon as possible.

All fields marked with an asterisk (*) are mandatory.

If you would like to request a quote for 5 or more students, please contact CustomerService@learnquest.com to be assigned an account representative.

Need more Information?

Speak with our training specialists to continue your learning journey.

 

Delivery Formats

Close

By submitting this form, I agree to LearnQuest's Terms and Conditions

heres the new schedule
This website uses third-party profiling cookies to provide services in line with the preferences you reveal while browsing the Website. By continuing to browse this Website, you consent to the use of these cookies. If you wish to object such processing, please read the instructions described in our Privacy Policy.
Your use of this LearnQuest site affirms your consent to our use of session and persistent cookies to track how you use our website.