In this chapter, we discussed the assessment of web servers and web applications. We started the chapter with a discussion on the OWASP Top Ten. Following the discussion, we used the WebGoat tool and performed a number of lessons that show the concepts and techniques for web application testing.

Following the work with the OWASP Top Ten, we looked at methods to identify a web application firewall between us and the target. We used the wafw00f tool to potentially detect the type of protection that is deployed.

Once we had looked at how to detect a WAF, we then discussed how to penetrate it. We looked at methods of obfuscation we can use to try and get past the protection provided by the WAF. We submitted our sample strings to the ModSecurity demo site and we successfully evaded detection with both an SQL injection string and a XSS string.

Finally, we closed the chapter with a discussion on the need for tools when it comes to web testing, especially web application testing.

This concludes...