The Basics of Web Hacking - 1st Edition - ISBN: 9780124166004, 9780124166592

The Basics of Web Hacking

1st Edition

Tools and Techniques to Attack the Web

Authors: Josh Pauli
eBook ISBN: 9780124166592
Paperback ISBN: 9780124166004
Imprint: Syngress
Published Date: 22nd July 2013
Page Count: 160
Sales tax will be calculated at check-out Price includes VAT/GST
Price includes VAT/GST

Institutional Access

Secure Checkout

Personal information is secured with SSL technology.

Free Shipping

Free global shipping
No minimum order.


The Basics of Web Hacking introduces you to a tool-driven process to identify the most widespread vulnerabilities in Web applications. No prior experience is needed. Web apps are a "path of least resistance" that can be exploited to cause the most damage to a system, with the lowest hurdles to overcome. This is a perfect storm for beginning hackers. The process set forth in this book introduces not only the theory and practical information related to these vulnerabilities, but also the detailed configuration and usage of widely available tools necessary to exploit these vulnerabilities.

The Basics of Web Hacking provides a simple and clean explanation of how to utilize tools such as Burp Suite, sqlmap, and Zed Attack Proxy (ZAP), as well as basic network scanning tools such as nmap, Nikto, Nessus, Metasploit, John the Ripper, web shells, netcat, and more. Dr. Josh Pauli teaches software security at Dakota State University and has presented on this topic to the U.S. Department of Homeland Security, the NSA, BlackHat Briefings, and Defcon. He will lead you through a focused, three-part approach to Web security, including hacking the server, hacking the Web app, and hacking the Web user.

With Dr. Pauli’s approach, you will fully understand the what/where/why/how of the most widespread Web vulnerabilities and how easily they can be exploited with the correct tools. You will learn how to set up a safe environment to conduct these attacks, including an attacker Virtual Machine (VM) with all necessary tools and several known-vulnerable Web application VMs that are widely available and maintained for this very purpose. Once you complete the entire process, not only will you be prepared to test for the most damaging Web exploits, you will also be prepared to conduct more advanced Web hacks that mandate a strong base of knowledge.

Key Features

  • Provides a simple and clean approach to Web hacking, including hands-on examples and exercises that are designed to teach you how to hack the server, hack the Web app, and hack the Web user
  • Covers the most significant new tools such as nmap, Nikto, Nessus, Metasploit, John the Ripper, web shells, netcat, and more!
  • Written by an author who works in the field as a penetration tester and who teaches Web security classes at Dakota State University


Beginning Information Security professionals, systems administrators, information technology leaders, network administrators, and an academic audience among information security majors.

Table of Contents



Honey Bear


Baby Bird

Family and Friends

Security Community

Scott White—Technical Reviewer

Syngress Team

My Vices




About This Book

A Hands-On Approach

What's in This Book?

A Quick Disclaimer

Chapter 1. The Basics of Web Hacking

Chapter Rundown:


What Is a Web Application?

What You Need to Know About Web Servers

What You Need to Know About HTTP

The Basics of Web Hacking: Our Approach

Web Apps Touch Every Part of IT

Existing Methodologies

Most Common Web Vulnerabilities

Setting Up a Test Environment

Chapter 2. Web Server Hacking

Chapter Rundown:



Port Scanning

Vulnerability Scanning


Maintaining Access

Chapter 3. Web Application Recon and Scanning

Chapter Rundown:


Web Application Recon

Web Application Scanning

Chapter 4. Web Application Exploitation with Injection

Chapter Rundown:


SQL Injection Vulnerabilities

SQL Injection Attacks


Operating System Command Injection Vulnerabilities

Operating System Command Injection Attacks

Web Shells

Chapter 5. Web Application Exploitation with Broken Authentication and Path Traversal

Chapter Rundown:


Authentication and Session Vulnerabilities

Path Traversal Vulnerabilities

Brute Force Authentication Attacks

Session Attacks

Path Traversal Attacks

Chapter 6. Web User Hacking

Chapter Rundown:


Cross-Site Scripting (XSS) Vulnerabilities

Cross-Site Request Forgery (CSRF) Vulnerabilities

Technical Social Engineering Vulnerabilities

Web User Recon

Web User Scanning

Web User Exploitation

Cross-Site Scripting (XSS) Attacks

Reflected XSS Attacks

Stored XSS Attacks

Cross-Site Request Forgery (CSRF) Attacks

User Attack Frameworks

Chapter 7. Fixes

Chapter Rundown:


Web Server Fixes

Web Application Fixes

Web User Fixes

Chapter 8. Next Steps

Chapter Rundown:


Security Community Groups and Events

Formal Education


Additional Books



No. of pages:
© Syngress 2013
eBook ISBN:
Paperback ISBN:

About the Author

Josh Pauli

Dr. Josh Pauli received his Ph.D. in Software Engineering from North Dakota State University (NDSU) and now serves as an Associate Professor of Information Security at Dakota State University (DSU) in Madison, SD. Dr. Pauli has published nearly 30 international journal and conference papers related to software security and his work includes invited presentations from the Department of Homeland Security, National Security Agency, Black Hat Briefings, and Defcon. He teaches both undergraduate and graduate courses in software security at DSU.


"...this book does provide an excellent introduction to the subject, and does so in a very practical way that explains the issues and techniques very clearly. Even if you’re not interested in becoming a hacker (or penetration tester) it’s a worthwhile read if you want to understand the problem..."--Network Security,August 1 2013

Ratings and Reviews