Web application hacking resources

Here's some links I provided to my sec560 students this week for the web application hacking section of the course.

Some of these were part of a list I put together last year which ended up getting posted to the OWASP blog at http://owasp.blogspot.com/2009/12/sql-injection-resources.html, but I've added a few new items as well.

By the way, if you are in the northern New Jersey area & would like to participate in a monthly infosec meeting, my sec560 students & I are going to put together an informal group which will meet monthly in the Parsippany NJ area (most likely at a bar & grill or coffee house) to discuss current industry events, share knowledge & have a few laughs, all are welcome!

Cheers,

RP


Web application hacking resources


Vulnerable WebApps:

OWASPBWA - https://code.google.com/p/owaspbwa/wiki/ProjectSummary

GOAT - http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project

MOTH - http://www.bonsai-sec.com/en/research/moth.php

Damn Vulnerable Web App - http://www.dvwa.co.uk/

Gruyere - http://google-gruyere.appspot.com/

Mutillidae - http://www.irongeek.com/i.php?page=security/mutillidae-deliberately-vulnerable-php-owasp-top-10

Hackme Bank - http://www.foundstone.com/us/resources/proddesc/hacmebank.htm

Hackme Travel - http://www.foundstone.com/us/resources/proddesc/hacmetravel.htm

Hackme Shipping -
http://www.foundstone.com/us/resources/proddesc/hacmeshipping.htm

Hackme Casino - http://www.foundstone.com/us/resources/proddesc/hacmecasino.htm



Videos & webcasts:

Offensive Python for Web Hackers - http://www.securitytube.net/Offensive-Python-for-Web-Hackers-%28Blackhat%29-video.aspx

OWASP Appsec NYC 2008 -http://www.owasp.org/index.php/OWASP_NYC_AppSec_2008_Conference

Caught in the web series - http://www.coresecurity.com/content/ondemand-caught

Invasion of the browser snatchers series -http://www.coresecurity.com/content/on-demand-snatchers

Advanced SQL injection -http://www.irongeek.com/i.php?page=videos/joe-mccray-advanced-sql-injection

Websec 101 - http://www.foundstone.com/us/websec101.asp

Hackme Bank & Hackme Travel videos- http://www.foundstone.com/us/resources-videos.asp



Tools

Samurai Web Testing Framework (Live CD which contains most tools needed to perform web assesment) - http://samurai.inguardians.com

Google Hacking Database - http://www.hackersforcharity.org/ghdb/

Burpsuite - http://portswigger.net/suite/

W3AF - http://w3af.sourceforge.net/

Samurai plugins for Firefox (lots of great plugins here) - https://addons.mozilla.org/en-US/firefox/collection/samurai

Dirbuster plugin for Firefox - http://www.sittinglittleduck.com/DirBuster-1.0-RC1.xpi

Wikto - http://www.sensepost.com/labs/tools/pentest/wikto

Sqlmap - http://sqlmap.sourceforge.net/



Methodologies & references

OWASP Testing Guide - http://www.owasp.org/images/5/56/OWASP_Testing_Guide_v3.pdf

OWASP wiki, has lists of attacks with detailed descriptions & syntax - http://www.owasp.org/index.php/Category:Attack



Cheat Sheets

SQL Injection Cheat Sheet -http://ferruh.mavituna.com/sql-injection-cheatsheet-oku/

SQL Injection Cheat Sheet - http://michaeldaw.org/sql-injection-cheat-sheet

SQL Injection Cheat Sheet w/ filter evasion - http://ha.ckers.org/sqlinjection/

SQL Injection Cheat Sheets sorted by DB -http://pentestmonkey.net/index.php?option=com_content&task=category§ionid=9&id=24&Itemid=1

XSS Cheat Sheet w/ filter evasion - http://ha.ckers.org/xss.html

Web App Assesment Cheat Sheet -http://www.secguru.com/files/cheatsheet/webappcheatsheet2.pdf



Books:

Web Application Hackers Handbook - http://portswigger.net/wahh/

SQL Injection Attacks & Defense - http://www.amazon.com/Injection-Attacks-Defense-Justin-Clarke/dp/1597494240

XSS Attacks: Cross Site Scripting Exploits and Defense - https://www.amazon.com/XSS-Attacks-Scripting-Exploits-Defense/dp/tags-on-product/1597491543

The Oracle Hackers Handbook - http://www.amazon.com/dp/0470080221/ref=nosim?tag=siriusbtechnolog5-20



Whitepapers & slides-

Constricting the Web - Offensive Python for Web Hackers - http://media.blackhat.com/bh-us-10/whitepapers/Hamiel_Wielgoszewski/BlackHat-USA-2010-Hamiel-Wielgosweski-Constricting-the-Web-wp.pdf

OWASP article on Web application penetration testing -http://www.owasp.org/index.php/Web_Application_Penetration_Testing

Advanced SQL injection -http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf

Best of web application penetration testing tools -http://pauldotcom.com/TriplePlay-WebAppPenTestingTools.pdf

(The next two papers are a little old, but still quite useful)

Advanced SQL Injection in SQL Server -http://www.ngssoftware.com/papers/advanced_sql_injection.pdf

(More) Advanced SQL Injection in SQL server -http://www.ngssoftware.com/papers/more_advanced_sql_injection.pdf