Explore Products

Best Sellers

New Releases

Books

Videos

Audiobooks

Free Learning

Attacking and Exploiting Modern Web Applications

You're reading from Attacking and Exploiting Modern Web Applications Discover the mindset, techniques, and tools to perform modern web attacks and exploitation

Product type Paperback

Published in Aug 2023

Publisher Packt

ISBN-13 9781801816298

Length 338 pages

Edition 1st Edition

Languages

Solidity

Tools

Blockchain

Concepts

Web Security

Authors (2):

Simone Onofri

Donato Onofri

View More author details

Table of Contents (14) Chapters

Preface

1. Part 1: Attack Preparation

2. Chapter 1: Mindset and Methodologies FREE CHAPTER

3. Chapter 2: Toolset for Web Attacks and Exploitation

4. Part 2: Evergreen Attacks

5. Chapter 3: Attacking the Authentication Layer – a SAML Use Case

6. Chapter 4: Attacking Internet-Facing Web Applications – SQL Injection and Cross-Site Scripting (XSS) on WordPress

7. Chapter 5: Attacking IoT Devices – Command Injection and Path Traversal

8. Part 3: Novel Attacks

9. Chapter 6: Attacking Electron JavaScript Applications – from Cross-Site Scripting (XSS) to Remote Command Execution (RCE)

10. Chapter 7: Attacking Ethereum Smart Contracts – Reentrancy, Weak Sources of Randomness, and Business Logic

11. Chapter 8: Continuing the Journey of Vulnerability Discovery

12. Index

Why subscribe?

13. Other Books You May Enjoy

Further reading

This chapter covered many topics. If you want to go deeper, we’re happy to share some valuable resources with you:

[1] Perla, E. and Oldani, M. (2010). A Guide to Kernel Exploitation. Elsevier.
[2] CIS. (n.d.). Web Attacks. [online] Available at https://www.cisecurity.org/insights/spotlight/ei-isac-cybersecurity-spotlight-web-attack.
[3] attack.mitre.org. (2018). Initial Access, Tactic TA0001 - Enterprise | MITRE ATT&CK®. [online] Available at https://attack.mitre.org/tactics/TA0001/.
[4] PTES (2014). The Penetration Testing Execution Standard. [online] Pentest-standard.org. Available at http://www.pentest-standard.org/index.php/Main_Page.
[5] OWASP (n.d.). OWASP Web Security Testing Guide. [online] owasp.org. Available at https://owasp.org/www-project-web-security-testing-guide/.
[6] Onofri, S. and Napolitano, L. (2012). SPARQL Injection: attacking the triple store. [online] Available at https://owasp.org/www-pdf-archive/Onofri-NapolitanoOWASPDayItaly2012.pdf.
[7] GitHub. (2020). SpiderLabs/ModSecurity. [online] Available at https://github.com/SpiderLabs/ModSecurity.
[8] GitHub. (2023). OWASP ModSecurity Core Rule Set (CRS). [online] Available at https://github.com/coreruleset/coreruleset/blob/v4.0/dev/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf.
[9] GitHub. (n.d.). webshells/php at master · BlackArch/webshells. [online] Available at https://github.com/BlackArch/webshells/tree/master/php.
[10] [email protected] (2020). NIST SP 800-115. [online] NIST. Available at https://www.nist.gov/privacy-framework/nist-sp-800-115.
[11] Grossman, J. (2006). Vulnerability Stack. [online] Available at https://blog.jeremiahgrossman.com/2006/11/vulnerability-stack.html.
[12] Berners-Lee, T. and Connolly, D.W. (1995). Hypertext Markup Language – 2.0. [online] IETF. Available at https://www.rfc-editor.org/info/rfc1866.
[13] The Mentor (1986). .:: Phrack Magazine ::. [online] Phrack.org. Available at http://phrack.org/issues/7/3.html.
[14] Herzog, P. (2010a). OSSTMM 3 – The Open Source Security Testing Methodology Manual. [online] Available at https://www.isecom.org/OSSTMM.3.pdf.
[15] OWASP (n.d.). OWASP Application Security Verification Standard. [online] owasp.org. Available at https://owasp.org/www-project-application-security-verification-standard/.
[16] mobeenx (n.d.). Document Library. [online] PCI Security Standards Council. Available at https://www.pcisecuritystandards.org/document_library/.
[17] Searle, J. (n.d.). NESCOR Guide to Penetration Testing for Electric Utilities Version 3. [online] Available at https://smartgrid.epri.com/doc/NESCORGuidetoPenetrationTestingforElectricUtilities-v3-Final.pdf.
[18] attack.mitre.org. (n.d.). MITRE ATT&CK®. [online] Available at https://attack.mitre.org.

You have been reading a chapter from

Attacking and Exploiting Modern Web Applications

Published in: Aug 2023

Publisher: Packt

ISBN-13: 9781801816298

© 2023 Packt Publishing Limited All Rights Reserved

Register for a free Packt account to unlock a world of extra content!

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at $19.99/month. Cancel anytime

Authors (2)

Simone Onofri

Simone Onofri

Simone Onofri is a cybersecurity director with over two decades of experience in Red and Blue Teaming, vulnerability research, and product management. He has been an instructor at the Joint Intelligence and EW Training Centre and is associated with global companies such as HewlettPackard Enterprise. Simone has discovered various vulnerabilities and holds key certifications such as GXPN, GREM, GWAPT, OSCP, and OPSA. An active participant in organizations such as OWASP and ISECOM, he regularly speaks at major conferences, including TEDx. Simone is committed to inspiring and educating industry professionals and enthusiasts through his work, with a mission to create a positive influence.

See other products by Simone Onofri

Onofri

Onofri

Donato Onofri is a seasoned Red Team engineer. He has over a decade of experience in activities including reverse engineering, Red Teaming, threat research, and penetration testing. Passionate about both the offensive and defensive sides of cybersecurity, Donato has worked with industry leaders such as CrowdStrike and Hewlett-Packard Enterprise and as an advisor and engineer for governments and financial institutions. His research delves into state-of-the-art security techniques, malware analysis, and internals. He holds the GREM, GXPN, OSCP, OSCE, and OSWE certifications, and his expertise is underscored by multiple recognitions for vulnerability discovery.

See other products by Onofri

Personalised recommendations for you

Based on your interests and search pattern

The Aspiring CIO and CISO

The Aspiring CIO and CISO

This book helps entry, mid-level, and senior managers master soft skills, craft a compelling brand, and strategically plan their career in C-suite roles with the help of expert insights needed for success in digital leadership and executive roles.

Jun 2024 8h 32m

The Aspiring CIO and CISO

The Aspiring CIO and CISO

This book helps entry, mid-level, and senior managers master soft skills, craft a compelling brand, and strategically plan their career in C-suite roles with the help of expert insights needed for success in digital leadership and executive roles.

Jun 2024 8h 32m

The Aspiring CIO and CISO

The Aspiring CIO and CISO

This book helps entry, mid-level, and senior managers master soft skills, craft a compelling brand, and strategically plan their career in C-suite roles with the help of expert insights needed for success in digital leadership and executive roles.

Jun 2024 8h 32m

The Aspiring CIO and CISO

The Aspiring CIO and CISO

This book helps entry, mid-level, and senior managers master soft skills, craft a compelling brand, and strategically plan their career in C-suite roles with the help of expert insights needed for success in digital leadership and executive roles.

Jun 2024 8h 32m

The Aspiring CIO and CISO

The Aspiring CIO and CISO

This book helps entry, mid-level, and senior managers master soft skills, craft a compelling brand, and strategically plan their career in C-suite roles with the help of expert insights needed for success in digital leadership and executive roles.

Jun 2024 8h 32m

The Aspiring CIO and CISO

The Aspiring CIO and CISO

This book helps entry, mid-level, and senior managers master soft skills, craft a compelling brand, and strategically plan their career in C-suite roles with the help of expert insights needed for success in digital leadership and executive roles.

Jun 2024 8h 32m

The Aspiring CIO and CISO

The Aspiring CIO and CISO

This book helps entry, mid-level, and senior managers master soft skills, craft a compelling brand, and strategically plan their career in C-suite roles with the help of expert insights needed for success in digital leadership and executive roles.

Jun 2024 8h 32m

Malware Development for Ethical Hackers

Malware Development for Ethical Hackers

This book will help you understand malware development by delving into the intricate mechanisms of malware development, injection attacks, and advanced evasion strategies with over 80 real-life examples.

Jun 2024 13h 0m

Malware Development for Ethical Hackers

Malware Development for Ethical Hackers

This book will help you understand malware development by delving into the intricate mechanisms of malware development, injection attacks, and advanced evasion strategies with over 80 real-life examples.

Jun 2024 13h 0m

Malware Development for Ethical Hackers

Malware Development for Ethical Hackers

This book will help you understand malware development by delving into the intricate mechanisms of malware development, injection attacks, and advanced evasion strategies with over 80 real-life examples.

Jun 2024 13h 0m

Malware Development for Ethical Hackers

Malware Development for Ethical Hackers

This book will help you understand malware development by delving into the intricate mechanisms of malware development, injection attacks, and advanced evasion strategies with over 80 real-life examples.

Jun 2024 13h 0m

Malware Development for Ethical Hackers

Malware Development for Ethical Hackers

This book will help you understand malware development by delving into the intricate mechanisms of malware development, injection attacks, and advanced evasion strategies with over 80 real-life examples.

Jun 2024 13h 0m