There is no such thing as "perfect security" when it comes to keeping all systems intact and functioning properly. Good penetration (pen) testing creates a balance that allows a system to be secure while simultaneously being fully functional. With this book, you'll learn how to become an effective penetrator (i.e., a white hat or ethical hacker) in order to circumvent the security features of a Web application so that those features can be accurately evaluated and adequate security precautions can be put in place. After a review of the basics of web applications, you'll be introduced to web application hacking concepts and techniques such as vulnerability analysis, attack simulation, results analysis, manuals, source code, and circuit diagrams. These web application hacking concepts and techniques will prove useful information for ultimately securing the resources that need your protection. What you will learn from this book * Surveillance techniques that an attacker uses when targeting a system for a strike * Various types of issues that exist within the modern day web application space * How to audit web services in order to assess areas of risk and exposure * How to analyze your results and translate them into documentation that is useful for remediation * Techniques for pen-testing trials to practice before a live project Who this book is for This book is for programmers, developers, and information security professionals who want to become familiar with web application security and how to audit it. Wrox Professional guides are planned and written by working programmers to meet the real-world needs of programmers, developers, and IT professionals. Focused and relevant, they address the issues technology professionals face every day. They provide examples, practical solutions, and expert education in new technologies, all designed to help programmers do a better job.

Wrox Professional guides are planned and written by working programmers to meet the real-world needs of programmers, developers, and IT professionals. Focused and relevant, they address the issues technology professionals face every day. They provide examples, practical solutions, and expert education in new technologies, all designed to help programmers do a better job.

What the Book Covers:   The first two chapters of the book reviews the basics of web applications and their protocols, especially authentication aspects, as a launching pad for understanding the inherent security vulnerabilities, covered later in the book. Immediately after this coverage, The author gets right down to basics of information security, covering vulnerability analysis, attack simulation, and results analysis, focusing the reader on the “ outcomes” aspects needed for successful pen testing. The author schools the reader on how to present findings to internal and external critical stakeholders, and then moves on to remediation or hardening of the code and applications, rather than the servers (often covered in other books).

Real World Web Solutions: The culmination is Chapter 9, the build out of a personal pen testing lab, replete with a baseline list of products, with installation guidance: Linux – Fedora VMWare Apache MySQL PHP Perl JBoss OpenLDAP OpenSSL OpenSSH Windows (with IIS installed)

Each one of these products will have its respective installation covered as part of this book.  Where appropriate we will also go into the configuration of the product.  This is in preparation for the honeypot applications we will be installed as well, consisting of WebGoat Hacme