This is the first in a series of three articles on penetration testing for Web applications. The first installment provides the penetration tester with an overview of Web applications - how they work, how they interact with users, and most importantly how developers can expose data and systems with poorly written and secured Web application front-ends.

Note: It is assumed that the reader of this article has some knowledge of the HTTP protocol - specifically, the format of HTTP GET and POST requests, and the purpose of various header fields. This information is available in RFC2616.

Web applications are becoming more prevalent and increasingly more sophisticated, and as such they are critical to almost all major online businesses. As with most security issues involving client/server communications, Web application vulnerabilities generally stem from improper handling of client requests and/or a lack of input validation checking on the part of the developer.

[ Read more ]

Related items

• Review: Hacking Exposed Linux 2/e (8 May 2003)
• Review: Hack Attacks Revealed: A Complete Reference for UNIX, Windows, and Linux with Custom Security Toolkit 2/e (24 April 2003)
• Review: Hack Attacks Testing: How to Conduct Your Own Security Audit (1 April 2003)
• Review: Hack I.T. - Security Through Penetration Testing (18 August 2002)
• Review: White-Hat Security Arsenal: Tackling the Threats (18 August 2002)