Gilberto Najera-Gutierrez – författare

Over 80 recipes on how to identify, exploit, and test web application security with Kali Linux 2

About This Book

Familiarize yourself with the most common web vulnerabilities a web application faces, and understand how attackers take advantage of themSet up a penetration testing lab to conduct a preliminary assessment of attack surfaces and run exploitsLearn how to prevent vulnerabilities in web applications before an attacker can make the most of it

Who This Book Is For

This book is for IT professionals, web developers, security enthusiasts, and security professionals who want an accessible reference on how to find, exploit, and prevent security vulnerabilities in web applications. You should know the basics of operating a Linux environment and have some exposure to security technologies and tools.

What You Will Learn

Set up a penetration testing laboratory in a secure wayFind out what information is useful to gather when performing penetration tests and where to look for itUse crawlers and spiders to investigate an entire website in minutesDiscover security vulnerabilities in web applications in the web browser and using command-line toolsImprove your testing efficiency with the use of automated vulnerability scannersExploit vulnerabilities that require a complex setup, run custom-made exploits, and prepare for extraordinary scenariosSet up Man in the Middle attacks and use them to identify and exploit security flaws within the communication between users and the web serverCreate a malicious site that will find and exploit vulnerabilities in the user''s web browserRepair the most common web vulnerabilities and understand how to prevent them becoming a threat to a site''s security

In Detail

Web applications are a huge point of attack for malicious hackers and a critical area for security professionals and penetration testers to lock down and secure. Kali Linux is a Linux-based penetration testing platform and operating system that provides a huge array of testing tools, many of which can be used specifically to execute web penetration testing.

This book will teach you, in the form step-by-step recipes, how to detect a wide array of vulnerabilities, exploit them to analyze their consequences, and ultimately buffer attackable surfaces so applications are more secure, for you and your users.

Starting from the setup of a testing laboratory, this book will give you the skills you need to cover every stage of a penetration test: from gathering information about the system and the application to identifying vulnerabilities through manual testing and the use of vulnerability scanners to both basic and advanced exploitation techniques that may lead to a full system compromise. Finally, we will put this into the context of OWASP and the top 10 web application vulnerabilities you are most likely to encounter, equipping you with the ability to combat them effectively. By the end of the book, you will have the required skills to identify, exploit, and prevent web application vulnerabilities.

Style and approach

Taking a recipe-based approach to web security, this book has been designed to cover each stage of a penetration test, with descriptions on how tools work and why certain programming or configuration practices can become security vulnerabilities that may put a whole system, or network, at risk. Each topic is presented as a sequence of tasks and contains a proper explanation of why each task is performed and what it accomplishes.

Build your defense against web attacks with Kali Linux, including command injection flaws, crypto implementation layers, and web application security holes

About This Book

Know how to set up your lab with Kali LinuxDiscover the core concepts of web penetration testingGet the tools and techniques you need with Kali Linux

Who This Book Is For

Since this book sets out to cover a large number of tools and security fields, it can work as an introduction to practical security skills for beginners in security. In addition, web programmers and also system administrators would benefit from this rigorous introduction to web penetration testing. Basic system administration skills are necessary, and the ability to read code is a must.

What You Will Learn

Learn how to set up your lab with Kali LinuxUnderstand the core concepts of web penetration testingGet to know the tools and techniques you need to use with Kali LinuxIdentify the difference between hacking a web application and network hackingExpose vulnerabilities present in web servers and their applications using server-side attacksUnderstand the different techniques used to identify the flavor of web applicationsSee standard attacks such as exploiting cross-site request forgery and cross-site scripting flawsGet an overview of the art of client-side attacksExplore automated attacks such as fuzzing web applications

In Detail

Web Penetration Testing with Kali Linux - Third Edition shows you how to set up a lab, helps you understand the nature and mechanics of attacking websites, and explains classical attacks in great depth. This edition is heavily updated for the latest Kali Linux changes and the most recent attacks. Kali Linux shines when it comes to client-side attacks and fuzzing in particular.

From the start of the book, you''ll be given a thorough grounding in the concepts of hacking and penetration testing, and you''ll see the tools used in Kali Linux that relate to web application hacking. You''ll gain a deep understanding of classicalSQL, command-injection flaws, and the many ways to exploit these flaws. Web penetration testing also needs a general overview of client-side attacks, which is rounded out by a long discussion of scripting and input validation flaws.

There is also an important chapter on cryptographic implementation flaws, where we discuss the most recent problems with cryptographic layers in the networking stack.

The importance of these attacks cannot be overstated, and defending against them is relevant to most internet users and, of course, penetration testers.

At the end of the book, you''ll use an automated technique called fuzzing to identify flaws in a web application. Finally, you''ll gain an understanding of web application vulnerabilities and the ways they can be exploited using the tools in Kali Linux.

Style and approach

This step-by-step guide covers each topic with detailed practical examples. Every concept is explained with the help of illustrations using the tools available in Kali Linux.

Discover the most common web vulnerabilities and prevent them from becoming a threat to your site\'s securityKey FeaturesFamiliarize yourself with the most common web vulnerabilitiesConduct a preliminary assessment of attack surfaces and run exploits in your labExplore new tools in the Kali Linux ecosystem for web penetration testingBook DescriptionWeb applications are a huge point of attack for malicious hackers and a critical area for security professionals and penetration testers to lock down and secure. Kali Linux is a Linux-based penetration testing platform that provides a broad array of testing tools, many of which can be used to execute web penetration testing. Kali Linux Web Penetration Testing Cookbook gives you the skills you need to cover every stage of a penetration test – from gathering information about the system and application, to identifying vulnerabilities through manual testing. You will also cover the use of vulnerability scanners and look at basic and advanced exploitation techniques that may lead to a full system compromise. You will start by setting up a testing laboratory, exploring the latest features of tools included in Kali Linux and performing a wide range of tasks with OWASP ZAP, Burp Suite and other web proxies and security testing tools. As you make your way through the book, you will learn how to use automated scanners to find security ?aws in web applications and understand how to bypass basic security controls. In the concluding chapters, you will look at what you have learned in the context of the Open Web Application Security Project (OWASP) and the top 10 web application vulnerabilities you are most likely to encounter, equipping you with the ability to combat them effectively. By the end of this book, you will have acquired the skills you need to identify, exploit, and prevent web application vulnerabilities.What you will learnSet up a secure penetration testing laboratoryUse proxies, crawlers, and spiders to investigate an entire websiteIdentify cross-site scripting and client-side vulnerabilitiesExploit vulnerabilities that allow the insertion of code into web applicationsExploit vulnerabilities that require complex setupsImprove testing efficiency using automated vulnerability scannersLearn how to circumvent security controls put in place to prevent attacksWho this book is forKali Linux Web Penetration Testing Cookbook is for IT professionals, web developers, security enthusiasts, and security professionals who want an accessible reference on how to find, exploit, and prevent security vulnerabilities in web applications. The basics of operating a Linux environment and prior exposure to security technologies and tools are necessary.