Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can anyone suggest good resources to learn about vulnerabilities in and attacks on web sites, in a hands-on way, for someone with limited programming experience?

share|improve this question

closed as not constructive by Iszi, Gilles, Polynomial, Terry Chia, Scott Pack Oct 13 '12 at 21:06

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Possible duplicate of… ? I'm posting my answer here too anyway. – user1301428 Apr 8 '12 at 8:37
Or this..… Either way, both links are helpful to this question. – cutrightjm Apr 8 '12 at 22:03
This is a good resource (free video course by Troy Hunt): – Rob Sobers Jan 21 at 2:41
up vote 7 down vote accepted

OWASP has a couple of very interesting resources of this kind:

  • Hacme Bank: a banking application built with some vulnerabilities for you to find and try to exploit
  • The WebGoat Project: web application with several vulnerabilities. Every possible attack is explained in a specific lesson, so that you can concentrate on one technique at the time
share|improve this answer
That WebGoat Project page got me really excited. I may spend some time this weekend in full-on geek mode! Thanks for sharing. – kristina childs Mar 28 '13 at 22:55

I suggest you start by developing dynamic websites that involve a database, using HTML/CSS, a client side programming language (like JavaScript), and a dynamic language (PHP is a popular choice). To fully understand web security attacks, you need first to get familiar with the client/server architecture, and the way a dynamic language interacts with a database to retrieve/insert/modify data.

Once you grasp the basics of dynamic web development, you can start learning about attacks. The OWASP Guide Project is a great resource and a reference for experienced web penetration testers as well as newcomers. For hands-on training, just google for a vulnerable web application and you'll find many deliberately vulnerable apps to safely and legally practice against. DVWA is a good starting point.

The next step is learning about tools. I advise you not to use these until you fully understand the different attacks (XSS, SQLi, CSRF, RFI/LFI, XST, etc) and how to manually perform them. For a concise list of open source tools to use when assessing a web application, you can check this previous answer of mine.

share|improve this answer

I think that you ability to understand attacks of software is limited by your ability to create software. For people with limited programming experience interested in "web security" I would tell them to write a web application. It can be simple, but they need to know how it works from the developers point of view before they can understand how it can be manipulated to do tasks it wasn't designed to do.

share|improve this answer

this vulnerable web application will help you understand OWASP top 10 and the good thing is that it is challenging Mutiliade

share|improve this answer
Irongeek actually provides a bunch of vulnerable web apps, each on different platforms. Mutiliade is just one of them. Find them all here:… – Justin C May 15 '12 at 14:55

I know that there are sites like HackThisSite that take a hands on approach to teaching security. You can check those out. Once you have a fundamental understanding of the common exploits, doing a lot of reading (including this site!) can also help a lot.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.