Can anyone suggest good resources to learn about vulnerabilities in and attacks on web sites, in a hands-on way, for someone with limited programming experience?
-
Possible duplicate of security.stackexchange.com/questions/13543/… ? I'm posting my answer here too anyway.– user1301428Apr 8, 2012 at 8:37
-
Or this.. security.stackexchange.com/questions/3592/… Either way, both links are helpful to this question.– cutrightjmApr 8, 2012 at 22:03
-
This is a good resource (free video course by Troy Hunt): info.varonis.com/web-security-fundamentals– Rob SobersJan 21, 2016 at 2:41
6 Answers
OWASP has a couple of very interesting resources of this kind:
- Hacme Bank: a banking application built with some vulnerabilities for you to find and try to exploit
- The WebGoat Project: web application with several vulnerabilities. Every possible attack is explained in a specific lesson, so that you can concentrate on one technique at the time
-
That WebGoat Project page got me really excited. I may spend some time this weekend in full-on geek mode! Thanks for sharing. Mar 28, 2013 at 22:55
I suggest you start by developing dynamic websites that involve a database, using HTML/CSS, a client side programming language (like JavaScript), and a dynamic language (PHP is a popular choice). To fully understand web security attacks, you need first to get familiar with the client/server architecture, and the way a dynamic language interacts with a database to retrieve/insert/modify data.
Once you grasp the basics of dynamic web development, you can start learning about attacks. The OWASP Guide Project is a great resource and a reference for experienced web penetration testers as well as newcomers. For hands-on training, just google for a vulnerable web application and you'll find many deliberately vulnerable apps to safely and legally practice against. DVWA is a good starting point.
The next step is learning about tools. I advise you not to use these until you fully understand the different attacks (XSS, SQLi, CSRF, RFI/LFI, XST, etc) and how to manually perform them. For a concise list of open source tools to use when assessing a web application, you can check this previous answer of mine.
Sans has a Web Penetration Testing and Ethical Hacking: Capture the Flag class you might be interested at https://www.sans.org/security-training/web-penetration-testing-ethical-hacking-capture-flag-day-6-13632-cid
There are some capture the flag sites that you might learn from using
- http://hax.tor.hu/
- https://pwn0.com/
- http://www.smashthestack.org/
- http://www.hellboundhackers.org/
- http://www.overthewire.org/wargames/
- http://counterhack.net/Counter_Hack/Challenges.html
- http://www.hackthissite.org/
A larger list can be found at http://captf.com/practice-ctf/
I think that you ability to understand attacks of software is limited by your ability to create software. For people with limited programming experience interested in "web security" I would tell them to write a web application. It can be simple, but they need to know how it works from the developers point of view before they can understand how it can be manipulated to do tasks it wasn't designed to do.
this vulnerable web application will help you understand OWASP top 10 and the good thing is that it is challenging Mutiliade
-
Irongeek actually provides a bunch of vulnerable web apps, each on different platforms. Mutiliade is just one of them. Find them all here: irongeek.com/i.php?page=security/…– Justin CMay 15, 2012 at 14:55
I know that there are sites like HackThisSite that take a hands on approach to teaching security. You can check those out. Once you have a fundamental understanding of the common exploits, doing a lot of reading (including this site!) can also help a lot.