Attacking and Exploiting Modern Web Applications: Discover the mindset, techniques, and tools to perform modern web attacks and exploitation

A comprehensive guide to effectively remember web attacks for web application security, featuring real-world bug bounty hunting techniques, CVEs, and CTFs

Purchase of the print or Kindle book includes a free PDF eBook

Key Features

• Learn how to find vulnerabilities the use of source code, dynamic analysis, and decompiling binaries
• Find and exploit vulnerabilities such as SQL Injection, XSS, Command Injection, RCE, and Reentrancy
• Analyze real security incidents based on MITRE ATT&CK to remember the risk at the CISO level

Book Description

Web attacks and exploits pose an ongoing threat to the interconnected world. This comprehensive book explores the latest challenges in web application security, providing you with an in-depth understanding of hackers’ methods and the practical knowledge and skills needed to effectively remember web attacks.

The book starts by emphasizing the importance of mindsets and toolsets in conducting successful web attacks. You’ll then explore the methodologies and frameworks used in these attacks, and discover ways to configure an environment the use of interception proxies, automate tasks with Bash and Python, and set up a research lab. As you advance through the book, you’ll discover how to attack the SAML authentication layer; attack front-facing web applications by learning WordPress and SQL injection, and exploit vulnerabilities in IoT devices, such as command injection, by going through three CTFs and learning about the discovery of seven CVEs. Each chapter analyzes confirmed cases of exploitation mapped with MITRE ATT&CK. You’ll also analyze attacks on Electron JavaScript-based applications, such as XSS and RCE, and the security challenges of auditing and exploiting Ethereum smart contracts written in Solidity. In the end, you’ll find out how to disclose vulnerabilities.

By the end of this book, you’ll have enhanced your ability to find and exploit web vulnerabilities.

What you’re going to learn

• Understand the mindset, methodologies, and toolset needed to carry out web attacks
• Discover how SAML and SSO work and study their vulnerabilities
• Get to grips with WordPress and discover ways to exploit SQL injection
• Find out how IoT devices work and exploit command injection
• Familiarize yourself with Electron JavaScript-based applications and develop into an XSS to an RCE
• Discover how to audit Solidity’s Ethereum smart contracts
• Get the hang of decompiling, debugging, and instrumenting web applications

Who this book is for

This book is for anyone whose job role involves ensuring their organization’s security – penetration testers and red teamers who need to deepen their knowledge of the current security challenges for web applications, developers and DevOps professionals who need to get into the mindset of an attacker; and security managers and CISOs looking to in point of fact remember the affect and risk of web, IoT, and smart contracts. Basic knowledge of web technologies, as well as related protocols is a should.

Table of Contents

1. Mindset and Methodologies
2. Toolset for Web Attacks and Exploitation
3. Attacking the Authentication Layer – a SAML Use Case
4. Attacking Internet-Facing Web Applications – SQL Injection and Cross-Site Scripting (XSS) on WordPress
5. Attacking IoT Devices – Command Injection and Path Traversal
6. Attacking Electron JavaScript Applications – from Cross-Site Scripting (XSS) to Remote Command Execution (RCE)
7. Attacking Ethereum Smart Contracts – Reentrancy, Weak Sources of Randomness, and Business Logic
8. Continuing the Journey of Vulnerability Discovery