7

Can anyone suggest good resources to learn about vulnerabilities in and attacks on web sites, in a hands-on way, for someone with limited programming experience?

9

OWASP has a couple of very interesting resources of this kind:

  • Hacme Bank: a banking application built with some vulnerabilities for you to find and try to exploit
  • The WebGoat Project: web application with several vulnerabilities. Every possible attack is explained in a specific lesson, so that you can concentrate on one technique at the time
| improve this answer | |
  • That WebGoat Project page got me really excited. I may spend some time this weekend in full-on geek mode! Thanks for sharing. – kristina childs Mar 28 '13 at 22:55
9

I suggest you start by developing dynamic websites that involve a database, using HTML/CSS, a client side programming language (like JavaScript), and a dynamic language (PHP is a popular choice). To fully understand web security attacks, you need first to get familiar with the client/server architecture, and the way a dynamic language interacts with a database to retrieve/insert/modify data.

Once you grasp the basics of dynamic web development, you can start learning about attacks. The OWASP Guide Project is a great resource and a reference for experienced web penetration testers as well as newcomers. For hands-on training, just google for a vulnerable web application and you'll find many deliberately vulnerable apps to safely and legally practice against. DVWA is a good starting point.

The next step is learning about tools. I advise you not to use these until you fully understand the different attacks (XSS, SQLi, CSRF, RFI/LFI, XST, etc) and how to manually perform them. For a concise list of open source tools to use when assessing a web application, you can check this previous answer of mine.

| improve this answer | |
4

Sans has a Web Penetration Testing and Ethical Hacking: Capture the Flag class you might be interested at https://www.sans.org/security-training/web-penetration-testing-ethical-hacking-capture-flag-day-6-13632-cid

There are some capture the flag sites that you might learn from using

A larger list can be found at http://captf.com/practice-ctf/

| improve this answer | |
2

I think that you ability to understand attacks of software is limited by your ability to create software. For people with limited programming experience interested in "web security" I would tell them to write a web application. It can be simple, but they need to know how it works from the developers point of view before they can understand how it can be manipulated to do tasks it wasn't designed to do.

| improve this answer | |
2

this vulnerable web application will help you understand OWASP top 10 and the good thing is that it is challenging Mutiliade

| improve this answer | |
1

I know that there are sites like HackThisSite that take a hands on approach to teaching security. You can check those out. Once you have a fundamental understanding of the common exploits, doing a lot of reading (including this site!) can also help a lot.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.