Web Application Testing. A Quick Guide to Testing and Security
0 likes510 views
The document is a quick guide to web application testing, emphasizing the importance of understanding common hacking tools and security measures. It advocates for strong password policies, two-factor authentication, and collaboration in penetration testing. It also highlights various resources and tools for web security testing, including Burp Suite and ModSecurity.
Web Application Testing. A Quick Guide to Testing and Security
- 1. Web Application Testing Quick guide to testing and references
- 2. C|EH DevOps I hate PCI Ruby on Rails Developer Pretend to know other things… I like turtles… No I will not hack into your wifes email. James Ruffer
- 3. Developers? Ruby? PHP? Python? Java? Android? Cobol? Fortran? Is .NET still around? PenTesters? Who are you?
- 4. Who is attacking you? ● Kiddy scripters ● Dumbasses ● Angry Hacker ● Professional Hacker ● Team of Hackers
- 5. Who should you protect yourself against? ● Kiddy Scripters ● Dumbasses How and Why?
- 7. HOW? Know the most common hacking tools: https://www.concise-courses.com/hacking- tools/top-ten/ BackTrack now known as https://www.kali.org/ http://www.metasploit.com/
- 8. Resources to stay up to date on OWASP Data Loss DB Verizon Report Hack this site Root this box www.owasp.org www.datalossdb.org www.verizonenterprise. com/DBIR/ www.hackthissite. org/pages/index/index.php
- 9. Please for the love of God...force some password rules like uppercase with number and special char...expire 90 days. Simple Two Factor solutions Google Two Factor Password Rules
- 11. Copy / Paste will save time BUT... Using other plugins or others code to save time is commonly done BUT have you actually looked at the code? Tested the code? Open Source code is the worst for exploits. OAuth plugin https://github.com/intridea/omniauth
- 12. How old is the github project?
- 13. Intro to burp suite for app testing Burp Suite is a great way to test MANY things but information gathering is first step.
- 15. Have a shared pentesting box with team. Read logs and update often. Comment in Git push after tests. Dedicated testing Box