1. Hacking web applications
Web App Testing 101.

2. About me (disk0nn3ct) Danny Chrastil disk0nn3ct
>I like to hack things
>Used to be in Web-Dev
>Hack for a living?
>Emphasis on web tech

3. Web App Testing 101 > Why attack web applications
./ Acceptance of online purchases
./ Accessibility of sensitive info
./ New Technology all the time
./ New Applications all the time

4. Web App Testing 101
> BASICS of Web Servers

5. Web App Testing 101
> BASICS of Web Requests

6. Web App Testing 101
> BASICS of State

7. Web App Testing 101
> How do we BREAK them?!

8. Web App Testing 101

9. Web App Testing 101 > There is a process… ./ Recon & Mapping
./ Discovery
./ Exploitation(you can break it now)

10. Web App Testing 101 > Process: ./ Recon & Mapping (BE THOROUGH)
.. Understand the application
.. What are its functions?
.. How is it supposed to work?
.. View Source!
.. Understand the technology
.. What is the server stack?
.. Is it built on a CMS?
.. Map the application
.. All directories and files

11. Web App Testing 101 > Process: ./ Discovery (DO NOT ATTACK YET)
.. Run scanner tools
.. BuRP, OWASP ZAP, Nikto, w3af
.. WebInspect, AppScan, NetSparker
.. Manual fuzzing
.. Proxy tool & Elbow Grease
.. OWASP TOP 10
.. XSS, SQLi, CSRF, Clickjacking

12. Web App Testing 101 > Process: ./ Exploitation (ATTACK!)
.. Manual is Best
.. Proxy & Elbow Grease
.. Attack Tools
.. W3af
.. SQLMap (SQL Injection)
.. BeEF (Broswer Exploitation)
.. Metasploit (Server CVEs)

13. Web App Testing 101
Let’s get our Hands Dirty

14. Web App Testing 101 http://snowfrocninjas.com ./ modify “hosts” file:
snowfrocninjas.com

15. Questions? (preguntas)