Attacking and Securing Java EE Web Applications is a lab-intensive, hands-on Java EE security training course that provides a unique coverage of Java application security. In this course, students begin with penetration testing, hunting for bugs in Java web applications. They then thoroughly examine best practices for defensively coding web applications, covering all the OWASP Top Ten as well as several additional prominent vulnerabilities (such as file uploads, CSRF and direct object references). Students will repeatedly attack and then defend various assets associated with fully functional web applications and services. This hands-on approach drives home the mechanics of how to secure JEE web applications in the most practical of terms.


* Actual course outline may vary depending on offering center. Contact your sales representative for more information.

Learning Objectives

Working in a dynamic, lab-intensive hands-on coding environment you’ll learn to:
Ensure that any bug hunting is performed in a safe and appropriate manner
Identify defect/bug reporting mechanisms within their organizations
Work with specific tools for targeted vulnerabilities
Avoid common mistakes that are made in bug hunting and vulnerability testing
Understand the concepts and terminology behind defensive, secure coding including the phases and goals of a typical exploit
Develop an appreciation for the need and value of a multilayered defense in depth
Understand potential sources for untrusted data
Understand the consequences for not properly handling untrusted data such as denial of service, cross-site scripting, and injections
To test web applications with various attack techniques to determine the existence of and effectiveness of layered defenses
Prevent and defend the many potential vulnerabilities associated with untrusted data
Understand the vulnerabilities of associated with authentication and authorization
Detect, attack, and implement defenses for authentication and authorization functionality and services
Understand the dangers and mechanisms behind Cross-Site Scripting (XSS) and Injection attacks
Detect, attack, and implement defenses against XSS and Injection attacks
Understand the risks associated with XML processing, file uploads, and server-side interpreters and how to best eliminate or mitigate those risks
Understand techniques and measures that can used to harden web and application servers as well as other components in your infrastructure

  • Why Hunt Bugs?

  • Security and Insecurity

    Dangerous Assumptions

    Attack Vectors

  • Safe and Appropriate Bug Hunting/Hacking

  • Working Ethically

    Respecting Privacy

    Bug/Defect Notification

    Bug Bounty Programs

  • Removing Bugs

  • Open Web Application Security Project (OWASP)

    OWASP Top Ten Overview

    Web Application Security Consortium

    CERT Secure Coding Standards

    Bug Hunting Mistakes to Avoid

    Tools and Resources

  • Principles of Information Security

  • Security Is a Lifecycle Issue

    Minimize Attack Surface Area

    Layers of Defense: Tenacious D


    Consider All Application States

    Do NOT Trust the Untrusted

    Tutorial: Working with Eclipse (JEE Version) and Apache TomEE 7x

    Tutorial: Working with the HSQL Database

  • Unvalidated Data

  • Buffer Overflows

    Integer Arithmetic Vulnerabilities

    Unvalidated Data: Crossing Trust Boundaries

    Defending Trust Boundaries

    Whitelisting vs Blacklisting

  • A1: Injection

  • Injection Flaws

    SQL Injection Attacks Evolve

    Drill Down on Stored Procedures

    Other Forms of Injection

    Minimizing Injection Flaws

  • A2: Broken Authentication

  • Quality and Protection of Authentication Data

    Handling Passwords on Server Side

    SessionID Risk Reduction

    HttpOnly and Security Headers

  • A3: Sensitive Data Exposure

  • Protecting Data Can Mitigate Impact

    In-Memory Data Handling

    Secure Pipes

    Failures in TLS/SSL Framework

  • A4: XML External Entities (XXE)

  • XML Parser Coercion

    XML Attacks: Structure

    XML Attacks: Injection

    Safe XML Processing

  • A5: Broken Access Control

  • Access Control Issues

    Excessive Privileges

    Insufficient Flow Control

    Unprotected URL/Resource Access

    Examples of Shabby Access Control

    Sessions and Session Management

  • A6: Security Misconfiguration

  • System Hardening: IA Mitigation

    Application Whitelisting

    Least Privileges


    Secure Baseline

  • A7: Cross Site Scripting (XSS)

  • XSS Patterns

    Persistent XSS

    Reflective XSS

    DOM-Based XSS

    Best Practices for Untrusted Data

  • A8/9: Deserialization/Vulnerable Components

  • Deserialization Issues

    Identifying Serialization and Deserializations

    Vulnerable Components

    Software Inventory

    Managing Updates

  • A10: Insufficient Logging and Monitoring

  • Fingerprinting a Web Site

    Error-Handling Issues

    Logging In Support of Forensics

    Solving DLP Challenges

  • Spoofing, CSRF, and Redirects

  • Name Resolution Vulnerabilities

    Fake Certs and Mobile Apps

    Targeted Spoofing Attacks

    Cross Site Request Forgeries (CSRF)

    CSRF Defenses

  • SDL Overview

  • Attack/Defense Basics

    Types of Security Controls

    Attack Phases: Offensive Actions and Defensive Controls

    Secure Software Development Processes

    Shifting Left

    Actionable Items Moving Forward

  • Applications: What Next?

  • Common Vulnerabilities and Exposures

    CWE/SANS Top 25 Most Dangerous SW Errors

    Strength Training: Project Teams/Developers

    Strength Training: IT Organizations

    Leveraging Common AppSec Practices and Control

  • Making Application Security Real

  • Cost of Continually Reinventing

    Paralysis by Analysis

    Actional Application Security

    Additional Tools for the Toolbox


This is an intermediate -level programming course, designed for experienced Java developers who wish to get up and running on developing well defended software applications. Familiarity with Java and Java EE is required and real world programming experience is highly recommended. Ideally students should have approximately 6 months to a year of Java and JEE working knowledge.




Students should have basic development skills and a working knowledge in the following topics, or attend these courses as a pre-requisite: TT5102 Java EE Web Application Development Essentials


Length: 4.0 days (32 hours)


Not Your Location? Change

Course Schedule:

Schedule select
10:00 AM ET -
6:00 PM ET
Filling Fast
Schedule select
10:00 AM ET -
6:00 PM ET
Filling Fast