Burp Suite Professional for IT Auditors: Validating and Documenting Web Application Vulnerabilities Training Course

Burp Suite Professional within the IT Audit Lifecycle

• The role of the tool across planning, fieldwork, and reporting phases.
• Differentiating manual validation from automated scanning.
• Establishing rules of engagement and securing testing authorization.

Workspace Configuration, Scope Definition, and Traffic Capture

• Setting up the proxy, browser, and TLS parameters.
• Defining scope rules and implementing out-of-scope protections.
• Managing project files and session handling for evidence preservation.

HTTP/HTTPS Traffic Analysis and Application Mapping

• Analysing request and response structures, including headers and cookies.
• Constructing site maps, discovering content, and identifying hidden endpoints.
• Reviewing API and JSON traffic patterns.

Validation of Security Configuration and Transport Controls

• Reviewing header, cookie, and CORS configurations.
• Inspecting TLS settings, HTTP methods, and error disclosure practices.
• Comparing configurations against agreed baselines.

Testing Authentication Controls

• Evaluating login, MFA, and credential policy behaviours.
• Assessing session tokens, fixation risks, and logout handling.
• Identifying weaknesses in token and JWT validation.

Testing Authorization and Access Controls

• Conducting horizontal and vertical privilege testing across different roles.
• Detecting insecure direct object references and forced browsing vulnerabilities.
• Documenting role matrix evidence and performing side-by-side comparisons.

Injection, Input Handling, and Out-of-Band Validation

• Confirming injection risks without using destructive payloads.
• Testing cross-site scripting and client-side sinks.
• Addressing blind and out-of-band scenarios using the Collaborator feature.

Business Logic and Workflow Testing

• Verifying multi-step workflows and sequence enforcement.
• Testing for parameter tampering related to price, quantity, and approvals.
• Identifying replay attacks, race conditions, and repeat-action abuses.

Scanner-Assisted Coverage, Extensions, and AI Assistance

• Configuring crawl and audit settings for comprehensive scoped coverage.
• Triaging issues and validating false positives.
• Implementing custom checks using BChecks and extensions.
• Utilising Burp AI and agentic testing while observing data handling limits.

Evidence Collection and Audit Documentation

• Compiling request and response evidence with accurate timestamps.
• Redacting sensitive data and managing evidence properly.
• Mapping findings to OWASP Top 10:2025, WSTG, and CWE standards.
• Rating risks using CVSS v4.0 and relevant audit criteria.

Capstone: Comprehensive Web Application Control Assessment

• Performing a scoped assessment of a training application.
• Preparing workpapers, a findings register, and a closing debrief.