Video description
Learn everything you need to execute web application security assessments as a professional ethical hacker.
About This Video
- It never gets boring, there will be always something interesting and new to learn.
- You will be never without a job. If you keep up with the developments, there will be always something new to do. And as long as there are new systems, people will keep screwing up and building insecure stuff. And that's what brings projects to us.
- So, I hope I piqued your attention to learning web application
In Detail
This course contains everything to start working as a web pentester. You will learn about exploitation techniques, hacking tools, methodologies, and the whole process of security assessments. It is absolutely hands-on, you will do all the attacks in your own penetration testing environment using the provided applications. The targets are real open-source software. You will have to work hard but in the end, you will be able to do web security assessments on your own as a real ethical hacker. My name is Geri and I am the instructor of this course about web application hacking. If you are interested in hacking and IT security, then this is the perfect place to start. You might be a developer, an IT administrator, or basically anybody with an IT background. With this training, you will get everything you need to start working as a professional web penetration tester. But, why would you want to become one? First of all, because it is a lot of fun. You can be in the position of an attacker trying to hack the various system. Finding vulnerabilities exploiting them and taking over the system. You can find the true hacker in yourself. It is a very creative and exciting job. Also, the security business is booming now. But, why should you learn web hacking? Mostly because there is the biggest demand in the market. Wherever you go to work right now as a penetration tester, around 80% of the projects are web hacking related. This is usually because the awareness of web security was already established and everything has a web interface from the web application to embedded devices or IoT. Also, because that is the fastest to learn. It is because web-related technologies are usually text-based and are easy to work with. So, at the end of the day, web pen testing is the fastest to learn and the most searched. So, I think it is an obvious choice to start your carrier there.
All the code files are placed at https://github.com/PacktPublishing/Web-Hacking-Become-a-Professional-Web-Pentester
Downloading the example code for this course: You can download the example code files for all Packt video courses you have purchased from your account at http://www.PacktPub.com. If you purchased this course elsewhere, you can visit http://www.PacktPub.com/support and register to have the files e-mailed directly to you.
Table of Contents
Chapter 1 : Warm up
Introduction
00:03:31
Disclaimer
00:01:34
Methodology
00:04:51
Chapter 2 : Environment setup
In this section
00:01:26
Setting up the target
00:08:57
Setting up Kali
00:14:37
Setting up the Burp Suite
00:09:04
Chapter 3 : Web 101
In this section
00:00:40
How HTTP works
00:12:37
Static HTML
00:10:07
PHP and friends
00:14:16
Modern MVC frameworks
00:29:16
JavaScript
00:14:35
Chapter 4 : Application discovery
Manual discovery
00:16:29
Automated discovery
00:11:47
Chapter 5 : Attacking session management
Session management intro
00:13:24
Session fixation
00:10:49
Weak logout
00:04:33
Same origin policy
00:07:03
CSRF
00:19:53
Securing the session
00:05:22
Chapter 6 : Attacking authentication
SSL/TLS
00:19:51
Authentication bypass
00:07:43
Unauthenticated URL access
00:05:57
Password quality
00:03:29
Password brute force
00:08:02
Default accounts
00:02:37
Weak password recovery
00:04:43
Mitigations
00:03:28
Chapter 7 : Attacking authorization
Authorization Intro
00:04:53
Manipulating variables
00:04:54
Client side authentication
00:04:07
Mitigations
00:02:14
Chapter 8 : Attacking the client
Reflected XSS
00:17:37
Stored XSS
00:10:24
HTTP header injection
00:10:54
Malicious URL redirection
00:13:50
Exploiting wrong content-type
00:08:11
Mitigations
00:04:02
Chapter 9 : Server side injections
Malicious file upload
00:14:17
LFI and RFI
00:14:08
OS command injection
00:13:25
SQL injection
00:17:46
UNION Select Attack
00:12:52
Blind SQL injection
00:13:52
Automating SQLi testing
00:11:53
Mitigations
00:04:07
Chapter 10 : The rest
Reporting
00:05:38
Checklist
00:04:33
What’s next
00:06:48