Book Overview & Buying
Table Of Contents
Feedback & Rating

Learning Python Web Penetration Testing

By : Christian Martorella

4.3 (33)

Buy this Book

Learning Python Web Penetration Testing

4.3 (33)

By: Christian Martorella

Buy this Book

Overview of this book

Web penetration testing is the use of tools and code to attack a website or web app in order to assess its vulnerability to external threats. While there are an increasing number of sophisticated, ready-made tools to scan systems for vulnerabilities, the use of Python allows you to write system-specific scripts, or alter and extend existing testing tools to find, exploit, and record as many security weaknesses as possible. Learning Python Web Penetration Testing will walk you through the web application penetration testing methodology, showing you how to write your own tools with Python for each activity throughout the process. The book begins by emphasizing the importance of knowing how to write your own tools with Python for web application penetration testing. You will then learn to interact with a web application using Python, understand the anatomy of an HTTP request, URL, headers and message body, and later create a script to perform a request, and interpret the response and its headers. As you make your way through the book, you will write a web crawler using Python and the Scrappy library. The book will also help you to develop a tool to perform brute force attacks in different parts of the web application. You will then discover more on detecting and exploiting SQL injection vulnerabilities. By the end of this book, you will have successfully created an HTTP proxy based on the mitmproxy tool.

Preface

Who this book is for

What this book covers

To get the most out of this book

Get in touch

Free Chapter

Introduction to Web Application Penetration Testing

Understanding the web application penetration testing process

Typical web application toolkit

Testing environment

Summary

Interacting with Web Applications

HTTP protocol basics

Anatomy of an HTTP request

Interacting with a web app using the requests library

Analyzing HTTP responses

Summary

Web Crawling with Scrapy – Mapping the Application

Web application mapping

Creating our own crawler/spider with Scrapy

Making our crawler recursive

Scraping interesting stuff

Summary

Resources Discovery

What is resource discovery?

Building our first BruteForcer

Analysing the results

Adding more information

Taking screenshots of the findings

Summary

Password Testing

How password attacks work

Our first password BruteForcer

Adding support for digest authentication

Form-based authentication

Summary

Detecting and Exploiting SQL Injection Vulnerabilities

Introduction to SQL injection

Detecting SQL injection issues

Exploiting a SQL injection to extract data

Advanced SQLi exploiting

Summary

Intercepting HTTP Requests

HTTP proxy anatomy

Introduction to mitmproxy

Manipulating HTTP requests

Automating SQLi in mitmproxy

Summary

Other Books You May Enjoy

Leave a review - let other readers know what you think

Customer Reviews

4.3 (33)

5 star

54.5%

4 star

36.4%

3 star

2 star

6.1%

1 star

Interacting with Web Applications

In the previous chapter, we learned about the web application security process and why it is important to test application security. In this chapter, we'll take a look at the following topics: