Course Outline
Burp Suite Professional in the IT Audit Process
- Tool role across planning, fieldwork and reporting
- Manual validation versus automated scanning
- Rules of engagement and testing authorization
Workspace Configuration, Scope and Traffic Capture
- Proxy, browser and TLS setup
- Scope rules and out-of-scope protection
- Project files and session handling for evidence
HTTP/HTTPS Traffic Analysis and Application Mapping
- Request and response structure, headers and cookies
- Site map, content discovery and hidden endpoints
- API and JSON traffic review
Security Configuration and Transport Control Validation
- Header, cookie and CORS configuration review
- TLS settings, HTTP methods and error disclosure
- Comparison against agreed configuration baselines
Authentication Control Testing
- Login, MFA and credential policy behaviour
- Session tokens, fixation and logout handling
- Token and JWT validation weaknesses
Authorization and Access Control Testing
- Horizontal and vertical privilege testing across roles
- Insecure direct object references and forced browsing
- Role matrix evidence and side-by-side comparison
Injection, Input Handling and Out-of-Band Validation
- Injection confirmation without destructive payloads
- Cross-site scripting and client-side sink testing
- Blind and out-of-band cases with Collaborator
Business Logic and Workflow Testing
- Multi-step workflow and sequence enforcement
- Price, quantity and approval parameter tampering
- Replay, race conditions and repeat-action abuse
Scanner-Assisted Coverage, Extensions and AI Assistance
- Crawl and audit configuration for scoped coverage
- Issue triage and false positive validation
- Custom checks with BChecks and extensions
- Burp AI and agentic testing with data handling limits
Evidence Collection and Audit Documentation
- Request and response evidence with timestamps
- Redaction of sensitive data and evidence handling
- Mapping findings to OWASP Top 10:2025, WSTG and CWE
- Risk rating with CVSS v4.0 and audit criteria
Capstone: End-to-End Web Application Control Assessment
- Scoped assessment of a training application
- Workpapers, findings register and closing debrief
Requirements
- Experience in IT auditing and IT security assessment
- Working knowledge of technology risk, security controls and network protocols
- Familiarity with HTTP/HTTPS and the OWASP framework
- Basic to intermediate use of web security testing tools such as Kali Linux and OWASP ZAP
Audience
- Senior and semi-senior IT auditors
- Technology risk and security control assessors
Custom Corporate Training
Training solutions designed exclusively for businesses.
- Customized Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
- Flexible Schedule: Dates and times adapted to your team's agenda.
- Format: Online (live), In-company (at your offices), or Hybrid.
Price per private group, online live training, starting from 4350 € + VAT*
Contact us for an exact quote and to hear our latest promotions
Testimonials (1)
The training helped me expand my knowledge and understanding of Burp Suite. I also realized that what I had learned through self-study was still quite limited. This training was very helpful to me as a QA because Burp Suite is a valuable tool for performing security testing and improving the overall quality of application testing. I will continue exploring this tool and learning more about its features and capabilities.
