Book Image

Mastering Kali Linux for Web Penetration Testing

By : Michael McPhee
Book Image

Mastering Kali Linux for Web Penetration Testing

By: Michael McPhee

Overview of this book

You will start by delving into some common web application architectures in use, both in private and public cloud instances. You will also learn about the most common frameworks for testing, such as OWASP OGT version 4, and how to use them to guide your efforts. In the next section, you will be introduced to web pentesting with core tools and you will also see how to make web applications more secure through rigorous penetration tests using advanced features in open source tools. The book will then show you how to better hone your web pentesting skills in safe environments that can ensure low-risk experimentation with the powerful tools and features in Kali Linux that go beyond a typical script-kiddie approach. After establishing how to test these powerful tools safely, you will understand how to better identify vulnerabilities, position and deploy exploits, compromise authentication and authorization, and test the resilience and exposure applications possess. By the end of this book, you will be well-versed with the web service architecture to identify and evade various protection mechanisms that are used on the Web today. You will leave this book with a greater mastery of essential test techniques needed to verify the secure design, development, and operation of your customers' web applications.
Table of Contents (13 chapters)

Walking into spider webs

Arachni is an open source scanner that focuses on the recon phase of our penetration testing in a different manner than any other tool out there. If you've used Arachni without paying attention to what makes it different (just like me), then you may find that changing your workflow will greatly improve results. The creator of the tool, Tasos Laskos, developed the tool to address a couple of opposed goals. First, scans can take an excessive amount of time (many hours to even weeks), and this makes these scans less than helpful. The time is lost and makes testing a more drawn-out process. Second, more data and coverage is a good thing, as it enhances accuracy, but it also adds additional time to the test process to complete the necessary transactions.

Laskos developed Arachni to reduce the amount of time for a scan while allowing the tool to scale such...