OWASP Top 10 Cyber RangeEach security domain contains labs representative of the ten categories of web application security risks presented by OWASP - Injection, Insecure Design, Identification/Authentication Failures, Broken Access Control, Software/Data Integrity, Security Logging/Monitoring Failures, Cryptographic Failures, Vulnerable/Outdated Components, Security Misconfiguration, Server-Side Request Forgery
Advanced Adversary Tactics - Privilege Escalation XSS
Secure Coding - Python
Security+ - AAA
Security+ - Cryptography
Privilege Escalation - Path Interception
PenTest+ - Applied Nmap
Common Attack Types - File Inclusion & Cross-Site Request Forgery (CSRF)
In this lab, you will learn about File Inclusion and Cross-Site Request Forgery attacks. File Inclusion vulnerabilities are caused when unvalidated input parameters are passed to back-end programming functions that access server files. The back end represents the server side of the application, specifically its code and database. An attacker can change the file name in an HTTP request and include malicious scripts instead. Depending on the script, the attacker can: Execute code on the server, Perform XSS attacks, Cause a Denial of Service (DOS), Manipulate data, and Access sensitive information.
Cross-site request forgery (CSRF), also known as XSRF, Sea Surf, or Session Riding, is a vulnerability where unauthorized commands are submitted from a user that the web application trusts. The delivery mechanisms for CSRF attacks are similar to those for Reflected XSS. An attacker uses social engineering to trick the victim into sending a forged request to a server. The server does not block the request since it is made from an authenticated user.
Common Attack Types - HTML & SQL Injections
In this lab, you will walk through an example of both HTML and SQL injections. HTML injections are vulnerabilities created from poor coding techniques and failure to sanitize user input that allow attackers to inject malicious payloads into the website's HTML code and modify its content. Based on the vulnerability, an attacker can change a few code lines, add entire forms that can then be used to trick users into providing sensitive information or change the website's entire layout.SQL injection is a web security vulnerability that permits an adversary to inject malicious SQL statements in the queries that an application makes to its database. It allows an unauthorized entity to view data to which they should not have access, like other users' information.
CySA+ Infrastructure Management
CySA+ Log, SIEM, and Email Analysis
Systems Administration - Access Control Lists
MITRE ATT&CK - Reconnaissance - Website Enumeration
Command Line Basics - User Accounts and Privileges
Command Line Basics - File Transfer Protocol (FTP)
MITRE ATT&CK - Initial Access - Exploiting Web Apps
MITRE ATT&CK - Initial Access - Exploiting Public-Facing Applications
MITRE ATT&CK - Initial Access - Broken Access Control
Penetration Testing with Metasploit - 4 - Post-Exploitation with the Meterpreter Lab
Plans & pricing
- Team administration and reporting
- Dedicated client success manager
Single sign-on (SSO)
Easily authenticate and manage your learners by connecting to any identity provider that supports the SAML 2.0 standard.
Integrations via API
Retrieve training performance and engagement metrics and integrate learner data into your existing LMS or HRS.
- 190+ role-guided learning paths and assessments (e.g., Incident Response)
- 100s of hands-on labs in cloud-hosted cyber ranges
- Create and assign custom learning paths
- Custom certification practice exams (e.g., CISSP, CISA)
- Optional upgrade: Guarantee team certification with live boot camps