This course is designed in such a way to address both the requirements of a Web Developer as well as a Web Pentester. For a Web Developer, he will get to know about secure coding, what all things can make his code insecure and how to identify security issues in his code. For the Web Security guy, it gives him an idea on how he should go with securing Node.js Application by performing effective Code Review, Implementing Secure Code, Pentesting, Automating the process of Code Review and finally exploiting the vulnerabilities identified.
As a take away, this course will introduce an open source Node.js Security Analysis tool named NodeJsScan, a Node.js Static Analysis Tool that can detect possible security issues, insecure code and outdated libraries. This tool allows you to extend the scan using it's customisable rule set. You can add your own rules on the go to catch security issues.
Finally this course is one of it's kind with hands on demonstration and walkthrough on identifying security issues, exploiting and fixing them.
The course will cover the following thing
• Node Specific Security Issues
• Global Namespace Pollution
• HTTP Parameter Pollution (HPP)
• eval() is Evil
• Remote OS Command Execution
• Untrusted User Input
• Regex DoS
• Information Disclosure
• Lack of Secure Code
• Code Review
• Automated Code Review with NodeJsScan