1.1 What Is Security Testing?
1.2 What Are Web Applications?
1.3 Web Application Fundamentals
1.4 Web App Security Testing
1.5 It’s About the How
Chapter 2. Installing Some Free Tools
2.1 Installing Firefox
2.2 Installing Firefox Extensions
2.3 Installing Firebug
2.4 Installing OWASP’s WebScarab
2.5 Installing Perl and Packages on Windows
2.6 Installing Perl and Using CPAN on Linux, Unix, or OS X
2.7 Installing CAL9000
2.8 Installing the ViewState Decoder
2.9 Installing cURL
2.10 Installing Pornzilla
2.11 Installing Cygwin
2.12 Installing Nikto 2
2.13 Installing Burp Suite
2.14 Installing Apache HTTP Server
Chapter 3. Basic Observation
3.1 Viewing a Page’s HTML Source
3.2 Viewing the Source, Advanced
3.3 Observing Live Request Headers with Firebug
3.4 Observing Live Post Data with WebScarab
3.5 Seeing Hidden Form Fields
3.6 Observing Live Response Headers with TamperData
3.7 Highlighting JavaScript and Comments
3.8 Detecting JavaScript Events
3.9 Modifying Specific Element Attributes
3.10 Track Element Attributes Dynamically
3.11 Conclusion
Chapter 4. Web-Oriented Data Encoding
4.1 Recognizing Binary Data Representations
4.2 Working with Base 64
4.3 Converting Base-36 Numbers in a Web Page
4.4 Working with Base 36 in Perl
4.5 Working with URL-Encoded Data
4.6 Working with HTML Entity Data
4.7 Calculating Hashes
4.8 Recognizing Time Formats
4.9 Encoding Time Values Programmatically
4.10 Decoding ASP.NET’s ViewState
4.11 Decoding Multiple Encodings
Chapter 5. Tampering with Input
5.1 Intercepting and Modifying POST Requests
5.2 Bypassing Input Limits
5.3 Tampering with the URL
5.4 Automating URL Tampering
5.5 Testing URL-Length Handling
5.6 Editing Cookies
5.7 Falsifying Browser Header Information
5.8 Uploading Files with Malicious Names
5.9 Uploading Large Files
5.10 Uploading Malicious XML Entity Files
5.11 Uploading Malicious XML Structure
5.12 Uploading Malicious ZIP Files
5.13 Uploading Sample Virus Files
5.14 Bypassing User-Interface Restrictions
Chapter 6. Automated Bulk Scanning
6.1 Spidering a Website with WebScarab
6.2 Turning Spider Results into an Inventory
6.3 Reducing the URLs to Test
6.4 Using a Spreadsheet to Pare Down the List
6.5 Mirroring a Website with LWP
6.6 Mirroring a Website with wget
6.7 Mirroring a Specific Inventory with wget
6.8 Scanning a Website with Nikto
6.9 Interpretting Nikto’s Results
6.10 Scan an HTTPS Site with Nikto
6.11 Using Nikto with Authentication
6.12 Start Nikto at a Specific Starting Point
6.13 Using a Specific Session Cookie with Nikto
6.14 Testing Web Services with WSFuzzer
6.15 Interpreting WSFuzzer’s Results
Chapter 7. Automating Specific Tasks with cURL
7.1 Fetching a Page with cURL
7.2 Fetching Many Variations on a URL
7.3 Following Redirects Automatically
7.4 Checking for Cross-Site Scripting with cURL
7.5 Checking for Directory Traversal with cURL
7.6 Impersonating a Specific Kind of Web Browser or Device
7.7 Interactively Impersonating Another Device
7.8 Imitating a Search Engine with cURL
7.9 Faking Workflow by Forging Referer Headers
7.10 Fetching Only the HTTP Headers
7.11 POSTing with cURL
7.12 Maintaining Session State
7.13 Manipulating Cookies
7.14 Uploading a File with cURL
7.15 Building a Multistage Test Case
7.16 Conclusion
Chapter 8. Automating with LibWWWPerl
8.1 Writing a Basic Perl Script to Fetch a Page
8.2 Programmatically Changing Parameters
8.3 Simulating Form Input with POST
8.4 Capturing and Storing Cookies
8.5 Checking Session Expiration
8.6 Testing Session Fixation
8.7 Sending Malicious Cookie Values
8.8 Uploading Malicious File Contents
8.9 Uploading Files with Malicious Names
8.10 Uploading Viruses to Applications
8.11 Parsing for a Received Value with Perl
8.12 Editing a Page Programmatically
8.13 Using Threading for Performance
Chapter 9. Seeking Design Flaws
9.1 Bypassing Required Navigation
9.2 Attempting Privileged Operations
9.3 Abusing Password Recovery
9.4 Abusing Predictable Identifiers
9.5 Predicting Credentials
9.6 Finding Random Numbers in Your Application
9.7 Testing Random Numbers
9.8 Abusing Repeatability
9.9 Abusing High-Load Actions
9.10 Abusing Restrictive Functionality
9.11 Abusing Race Conditions
Chapter 10. Attacking AJAX
10.1 Observing Live AJAX Requests
10.2 Identifying JavaScript in Applications
10.3 Tracing AJAX Activity Back to Its Source
10.4 Intercepting and Modifying AJAX Requests
10.5 Intercepting and Modifying Server Responses
10.6 Subverting AJAX with Injected Data
10.7 Subverting AJAX with Injected XML
10.8 Subverting AJAX with Injected JSON
10.9 Disrupting Client State
10.10 Checking for Cross-Domain Access
10.11 Reading Private Data via JSON Hijacking
Chapter 11. Manipulating Sessions
11.1 Finding Session Identifiers in Cookies
11.2 Finding Session Identifiers in Requests
11.3 Finding Authorization Headers
11.4 Analyzing Session ID Expiration
11.5 Analyzing Session Identifiers with Burp
11.6 Analyzing Session Randomness with WebScarab
11.7 Changing Sessions to Evade Restrictions
11.8 Impersonating Another User
11.9 Fixing Sessions
11.10 Testing for Cross-Site Request Forgery
Chapter 12. Multifaceted Tests
12.1 Stealing Cookies Using XSS
12.2 Creating Overlays Using XSS
12.3 Making HTTP Requests Using XSS
12.4 Attempting DOM-Based XSS Interactively
12.5 Bypassing Field Length Restrictions (XSS)
12.6 Attempting Cross-Site Tracing Interactively
12.7 Modifying Host Headers
12.8 Brute-Force Guessing Usernames and Passwords
12.9 Attempting PHP Include File Injection Interactively
12.10 Creating Decompression Bombs
12.11 Attempting Command Injection Interactively
12.12 Attempting Command Injection Systematically
12.13 Attempting XPath Injection Interactively
12.14 Attempting Server-Side Includes (SSI) Injection Interactively
12.15 Attempting Server-Side Includes (SSI) Injection Systematically
12.16 Attempting LDAP Injection Interactively
12.17 Attempting Log Injection Interactively
Index