Getting started with web app security testing

Much of the modern web is running on applications that are behind hundreds of web, application, and database servers as their backend systems. The web has progressed from static HTML pages to sophisticated asynchronous applications that require more resources to compute. Although the web has changed, some of the most common security issues have not. Vulnerabilities first discovered in the 1990s are still relevant and actively being exploited. In IoT products, some of these common vulnerabilities are often command injection, Cross-site scripting (XSS), directory traversal, authentication bypass, session hijacking, XML External Entity (XXE), cross-site request forgery (CSRF), and other business logic flaws. In this recipe, we will establish a web application testing methodology to be used for finding and exploiting IoT web application...