Web App Security Testing with Mutillidae: Finding Vulnerabilities

This lab introduces essential ethical hacking concepts and practical penetration testing techniques. Learners will explore various tools to identify and exploit vulnerabilities while following responsible security practices to build foundational cybersecurity skills.

Learn the basics of network exploration and security auditing using Nmap and its graphical interface, Zenmap. This lab covers installing and operating Nmap and Zenmap on both Linux and Windows machines, understanding their commands, and performing various scans to identify IP addresses, hosts, operating systems, and services.

Gain practical experience assessing wireless network environments using Parrot OS and Wifite. Identify wireless interfaces, configure a virtual machine with an external USB adapter, scan nearby wireless networks, and interpret results in a controlled security testing environment.

Gain practical experience using multiple penetration testing tools to identify, validate, and analyze security weaknesses in systems and web applications. Interpret tool findings to understand vulnerabilities and their potential impact on security.

Perform vulnerability assessment and traffic analysis using OWASP ZAP, Burp Suite, Nikto, and Wireshark to identify web application weaknesses, analyze HTTP traffic, detect server misconfigurations, and investigate insecure network communications.

Perform vulnerability assessment activities using security tools to identify, analyze, and evaluate potential weaknesses, while examining phishing, QR-based phishing, and infectious media techniques in controlled environments.

Perform comprehensive information gathering across network scanning, passive fingerprinting, packet analysis, domain enumeration, and OSINT using Parrot OS and tools such as Nmap, Netdiscover, p0f, Dmitry, and Recon-ng.

Develop practical API security testing skills by configuring Postman and Burp Suite, analyzing API traffic, identifying common vulnerabilities, automating fuzzing and static analysis, processing JSON responses, and generating security tests with AI.