0

I'm new in web pentesting and I have read a lot of books.

But I think I should read some RFC to have a better knowledge about web applications.

There is a lot of RFC and I'm a bit lost on which one should I read...

i'm starting with RFC3986 but which ones would you recommend me after this one, please ?

Improve this question
  • 1
    I don't think you should read RFCs. The best way to proceed will be reading something about security and things you are interested in. Go on root-me.org or other sites to learn how to pentest. You can start reading RFCs when you are focused on a Problem and ned to know the specific flow of a protocol – CDRohling Jun 27 '19 at 13:40
4

Pentesting isn't about knowing RFCs by heart. If there is a specific information you need for a specific test, you can always just look it up.

It's much better to have broad fundamental knowledge, and know where to find specifics, rather than to attempt to cram as much specific knowledge into your head as you can.

The question "Which books should I read when starting Pentesting?" is very opinion-based, and will not be answered, as those answers would be outdated very quickly. One resource that comes up often is the OWASP Top 10, as those are vulnerabilities that come up very often, and understanding those will help you quite a bit.

Don't be afraid of asking well-formulated questions regarding your understanding of specific topic, even if they are not attached to a real-world problem.

Improve this answer
  • Thanks for the answer, I know about most of the vulnerabilities but I'm kinda lost to what to do next to be able to come up with creative vulnerabilities... – Neolex Jun 28 '19 at 22:01
  • 1
    @Neolex I don't know what you mean with "creative vulnerabilities". How long have you been pentester yet? I'm not trying to shame you for being new, I'm just trying to understand your background – MechMK1 Jun 29 '19 at 11:23
  • I'm not a pentester the only experience I have is OSCP but I don't manage to get creative ideas, I just test vulnerabilities I know like IDOR.Some top hacker bug hunter a really outside of the box thinker when it comes to hunting and I just test things I have read or seen before. – Neolex Jun 30 '19 at 9:38
  • 1
    @Neolex To find this kind of vulnerabilities, you need quite a lot of practical experience. "Just" looking for common vulnerabilities like IDOR, SQLi, XSS, CSRF, etc. is perfectly okay. You're new, and you're learning. Don't expect to become "1337" overnight, just give it time. – MechMK1 Jun 30 '19 at 11:19
  • Ok ^^ Thank you for taking the time to answer my silly questions ^^ have a good day ! – Neolex Jul 1 '19 at 7:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.