Practical Web Penetration Testing

Secure web applications using Burp Suite, Nmap, Metasploit, and more

Gus Khawaja

• Publisher: Packt Publishing
• Year: 2018
• eBook ISBN: 9781788628723
• Edition: 1
• Topic: Ciencia de la computación
• Subtopic: Ciberseguridad

Learn how to execute web application penetration testing end-to-endAbout This Book• Build an end-to-end threat model landscape for web application security• Learn both web application vulnerabilities and web intrusion testing• Associate network vulnerabilities with a web application infrastructureWho This Book Is ForPractical Web Penetration Testing is for you if you are a security professional, penetration tester, or stakeholder who wants to execute penetration testing using the latest and most popular tools. Basic knowledge of ethical hacking would be an added advantage.What You Will Learn• Learn how to use Burp Suite effectively• Use Nmap, Metasploit, and more tools for network infrastructure tests• Practice using all web application hacking tools for intrusion tests using Kali Linux• Learn how to analyze a web application using application threat modeling• Know how to conduct web intrusion tests• Understand how to execute network infrastructure tests• Master automation of penetration testing functions for maximum efficiency using PythonIn DetailCompanies all over the world want to hire professionals dedicated to application security. Practical Web Penetration Testing focuses on this very trend, teaching you how to conduct application security testing using real-life scenarios.To start with, you'll set up an environment to perform web application penetration testing. You will then explore different penetration testing concepts such as threat modeling, intrusion test, infrastructure security threat, and more, in combination with advanced concepts such as Python scripting for automation. Once you are done learning the basics, you will discover end-to-end implementation of tools such as Metasploit, Burp Suite, and Kali Linux. Many companies deliver projects into production by using either Agile or Waterfall methodology. This book shows you how to assist any company with their SDLC approach and helps you on your journey to becoming an application security specialist.By the end of this book, you will have hands-on knowledge of using different tools for penetration testing.Style and approachIn this book, you will learn and understand the workflow of application security testing. Starting from analysis using threat modeling until the testing phase and before the web project goes into production, you will be able conduct effective penetrating testing using web intrusion tests, network infrastructure tests, and code review.

Application Threat Modeling

I have dedicated a whole chapter to this topic because people underestimate the importance of Application Threat Modeling (ATM). If you're an employee or a consultant in application security, you will always encounter projects that will deliver new releases of their product, and you will need to make sure to test these projects before they are deployed into the production servers. ATM happens at the beginning when the project is still in the Architecture phase. In fact, ATM is a security architecture document that allows you to identify future threats and to pinpoint the different pentest activities that need to be executed in the future deployment of the web application project.

Here's the plan for this amazing chapter:

• Introducing the software development life cycle
• Application Threat Modeling at a glance
• Application Threat Modeling in real life
• Application Threat Modeling document structure and contents
• A practical example of an Application Threat Modeling document

A lot of principles in this chapter (and this book, as well) can be found at the OWASP website. I highly recommend that you keep the OWASP website in mind for your application security daily tasks: http://www.owasp.org.

Software development life cycle

Every application proceeds into a development life cycle before it is deployed into production. First, the project team comes up with an idea for a new product (a website) that allows the business to earn more money and clients. This is the Analysis/Architecture phase, where everyone sits around the table to discuss all the challenges of this new project. At the end of this phase, an Architecture document will be produced and presented to the Architecture Board who will approve it if the project meets the company's policies. After the approval, the project will start in the Development phase, where a team of developers and quality assurance engineers will join together to deliver the product. After a few sprints, a stable release will be ready for deployment into the production; the team will test this application and make sure that it's free of bugs. If everything is good (gating), then the team will proceed and deploy the web application into the production environment:

You, as an application security professional, play an important role in this workflow. During the first Architecture/Analysis stage, you are required to attend the meetings to understand the new application. Once the architecture document is completed, you will create your ATM document. Later, during the Development phase, you will execute all the penetration tests activities (Source Code Review, Web Intrusion Tests, and Infrastructure Security Tests) based on the ATM document that you wrote at the beginning.

Application Threat Modeling at a glance

ATM is a methodology for analyzing the security posture of an application and it aims to help you lay out the foundations before starting the penetration testing activities. The document should address the security risks during the Architecture phase by identifying and quantifying them before project reaches the Development phase. You will see so many approaches out there for how to handle the threat modeling document (the best one that I recommend is the OWASP Application Threat Modeling document; check it out yourself and you will understand what I mean), but from my personal experience, I suggest you make it as simple as possible and don't waste your time over-describing the security risks of the ap...

Table of contents

• Title Page
• Copyright and Credits
• Packt Upsell
• Contributors
• Preface
• Building a Vulnerable Web Application Lab
• Kali Linux Installation
• Delving Deep into the Usage of Kali Linux
• All About Using Burp Suite
• Understanding Web Application Vulnerabilities
• Application Security Pre-Engagement
• Application Threat Modeling
• Source Code Review
• Network Penetration Testing
• Web Intrusion Tests
• Pentest Automation Using Python
• Nmap Cheat Sheet
• Metasploit Cheat Sheet
• Netcat Cheat Sheet
• Networking Reference Section
• Python Quick Reference
• Other Books You May Enjoy