OWASP Top 10 (Web & API)
CWE/SANS Top 25
Injection flaws (SQL, OS, LDAP, NoSQL)
XSS, CSRF, SSRF
Authentication & session management flaws
Access control vulnerabilities
Deserialization issues
Security misconfigurations
REST, GraphQL security testing
OAuth2, OpenID Connect, JWT security
API gateway security
Rate limiting, throttling, input validation
mTLS, certificate pinning
AWS, Azure, GCP security best practices
Kubernetes security
Container security
Infrastructure as Code security
Secrets management (Vault, KMS)
Cloud-native threat modeling
Secure CI/CD pipeline integration
GitHub/GitLab/Jenkins security plugins
Dependency vulnerability scanning
Artifact signing and verification
SBOM (Software Bill of Materials)
Supply chain security practices
Web application penetration testing
API penetration testing
Exploit validation and proof of concept
Use of Metasploit, Nmap, Wireshark
Reconnaissance and enumeration techniques
TLS/SSL configuration and hardening
Encryption standards (AES, RSA, SHA-2/3)
Key management practices
OWASP Top 10 (Web & API)
CWE/SANS Top 25
Injection flaws (SQL, OS, LDAP, NoSQL)
XSS, CSRF, SSRF
Authentication & session management flaws
Access control vulnerabilities
Deserialization issues
Security misconfigurations
REST, GraphQL security testing
OAuth2, OpenID Connect, JWT security
API gateway security
Rate limiting, throttling, input validation
mTLS, certificate pinning
AWS, Azure, GCP security best practices
Kubernetes security
Container security
Infrastructure as Code security
Secrets management (Vault, KMS)
Cloud-native threat modeling
Secure CI/CD pipeline integration
GitHub/GitLab/Jenkins security plugins
Dependency vulnerability scanning
Artifact signing and verification
SBOM (Software Bill of Materials)
Supply chain security practices
Web application penetration testing
API penetration testing
Exploit validation and proof of concept
Use of Metasploit, Nmap, Wireshark
Reconnaissance and enumeration techniques
TLS/SSL configuration and hardening
Encryption standards (AES, RSA, SHA-2/3)
Key management practices
OWASP Top 10 (Web & API)
CWE/SANS Top 25
Injection flaws (SQL, OS, LDAP, NoSQL)
XSS, CSRF, SSRF
Authentication & session management flaws
Access control vulnerabilities
Deserialization issues
Security misconfigurations
REST, GraphQL security testing
OAuth2, OpenID Connect, JWT security
API gateway security
Rate limiting, throttling, input validation
mTLS, certificate pinning
AWS, Azure, GCP security best practices
Kubernetes security
Container security
Infrastructure as Code security
Secrets management (Vault, KMS)
Cloud-native threat modeling
Secure CI/CD pipeline integration
GitHub/GitLab/Jenkins security plugins
Dependency vulnerability scanning
Artifact signing and verification
SBOM (Software Bill of Materials)
Supply chain security practices
Web application penetration testing
API penetration testing
Exploit validation and proof of concept
Use of Metasploit, Nmap, Wireshark
Reconnaissance and enumeration techniques
TLS/SSL configuration and hardening
Encryption standards (AES, RSA, SHA-2/3)
Key management practices