Everand Logo

Welcome to Everand!

  • Discover millions of ebooks, audiobooks, and so much more with a free trial

    Only $11.99/month after trial. Cancel anytime.

    How to Attack and Defend Your Website
    How to Attack and Defend Your Website
    How to Attack and Defend Your Website
    Ebook125 pages36 minutes

    How to Attack and Defend Your Website

    By Henry Dalziel

    ()

    Read preview

    About this ebook

    How to Attack and Defend Your Website is a concise introduction to web security that includes hands-on web hacking tutorials. The book has three primary objectives: to help readers develop a deep understanding of what is happening behind the scenes in a web application, with a focus on the HTTP protocol and other underlying web technologies; to teach readers how to use the industry standard in free web application vulnerability discovery and exploitation tools – most notably Burp Suite, a fully featured web application testing tool; and finally, to gain knowledge of finding and exploiting the most common web security vulnerabilities.

    This book is for information security professionals and those looking to learn general penetration testing methodology and how to use the various phases of penetration testing to identify and exploit common web protocols.

    How to Attack and Defend Your Website is be the first book to combine the methodology behind using penetration testing tools such as Burp Suite and Damn Vulnerable Web Application (DVWA), with practical exercises that show readers how to (and therefore, how to prevent) pwning with SQLMap and using stored XSS to deface web pages.

    • Learn the basics of penetration testing so that you can test your own website's integrity and security
    • Discover useful tools such as Burp Suite, DVWA, and SQLMap
    • Gain a deeper understanding of how your website works and how best to protect it
    LanguageEnglish
    PublisherElsevier Science
    Release dateDec 5, 2014
    ISBN9780128027547
    How to Attack and Defend Your Website
    Author

    Henry Dalziel

    Henry Dalziel is a serial education entrepreneur, founder of Concise Ac Ltd, online cybersecurity blogger and e-book author. He writes for the Concise-Courses.com blog and has developed numerous cybersecurity continuing education courses and books. Concise Ac Ltd develops and distributes continuing education content [books and courses] for cybersecurity professionals seeking skill enhancement and career advancement. The company was recently accepted onto the UK Trade & Investment's (UKTI) Global Entrepreneur Programme (GEP).

    Read more from Henry Dalziel

    Related to How to Attack and Defend Your Website

    Related ebooks

    Internet & Web For You

    View More
    View More

    Related podcast episodes

    Related articles

    • Article

      Hack The Planet/Parrot

      May 31, 2022

      Hack The Planet/Parrot
      2 min read

    • Article

      Hack The System

      Dec 17, 2019

      If you followed our handy guide on the previous pages, then you’ll already have augmented your Kali Light installation with Nmap, a port-scanning utility par excellence and a vital part of any pen-tester’s arsenal. As mentioned on the DVD page (there

      4 min read

    • Article

      Secure Your Servers

      Apr 7, 2020

      No matter what you do with your Linux servers you will almost certainly have SSH access to them. Indeed this might be the only access you have, so it would be wise to secure it. Naturally, you will already be using a strong password and will have alr

      4 min read

    • Article

      Introducing Kali

      Mar 2, 2021

      Introducing Kali
      4 min read

    • Article

      Hacker’s Manual

      Mar 2, 2021

      Hacker’s Manual
      1 min read

    • Article

      Hacker’s Manual

      Nov 17, 2020

      Hacker’s Manual
      1 min read

    • Article

      Kali Linux 2020.3 64-bit

      Nov 17, 2020

      Kali Linux 2020.3 64-bit
      3 min read

    • Article

      “Someone Who Under Takes A Ransomware Attack Isn’t A Hacker, They’re An Attacker”

      Aug 12, 2021

      If you’ve ever attended an infosec or cybersecurity event, you will no doubt have noticed the preponderance of “Hacking is NOT a Crime” stickers. In 2018, some 500 such stickers were handed out at the DEF CON 26 event, the following year 5,000 were d

      7 min read

    • Article

      Network Attacks

      Sep 21, 2020

      Though less common than malware and social engineering, network-based attacks are still a threat to every computer and mobile user, and everyone should have at least a basic understanding of what they are and how to avoid them. So this month let’s lo

      4 min read

    • Article

      Sherlock

      May 31, 2022

      Sherlock
      1 min read

    • Article

      Revisiting Tor

      Aug 24, 2020

      Revisiting Tor
      4 min read

    • Article

      Hacker’s Toolkit 2o22

      May 31, 2022

      Hacker’s Toolkit 2o22
      1 min read

    • Article

      Hello World Of Raspberry Pi

      Oct 19, 2021

      Ellora James is a fourth-year student who’s taking a university degree course on ethical hacking. I was first introduced to the Raspberry Pi back in high school, and I’ve been hooked ever since printing my first “Hello World” in Python. Recently, I s

      1 min read

    • Article

      Modern Hacking, Ethics And Statistics

      May 31, 2022

      Agerund and an infinitive walk in to the Linux kernel. They were hacking to learn. An awful adaptation of a (drinking to forget) joke, but a reasonable opener. An incredibly useful maxim from long ago hacker lore is “don’t learn to hack, hack to lear

      5 min read

    • Article

      Wireshark 4.0.2

      Mar 7, 2023

      Wireshark 4.0.2
      2 min read

    • Article

      Use Home Assistant NodeRED devices

      May 31, 2022

      NodeRED is an open source graphical programming environment that can be used to complete a large number of tasks. Graphical programming languages tend to be more intuitive than textual programming languages and can be easier to learn. Support is buil

      5 min read

    • Article

      Disrupting Databases

      Apr 19, 2021

      Disrupting Databases
      3 min read

    • Article

      Tsurugi Linux 2019.1

      Sep 24, 2019

      Tsurugi Linux 2019.1
      2 min read

    • Article

      Hacker Distributions

      Nov 17, 2020

      Hacker Distributions
      1 min read

    • Article

      Metasploitation

      May 2, 2023

      It’s a rare piece of code that never requires patching to fix some flaw or other that allows users to do what they were never meant to do. Exploits can be as simple as checking out plain text password files in an unprotected directory, or inputting s

      5 min read

    • Article

      Support And Community

      May 31, 2022

      Support And Community
      1 min read

    • Article

      Rise Of The Robots

      Jan 12, 2021

      Rise Of The Robots
      7 min read

    Related categories

    Reviews for How to Attack and Defend Your Website

    0 ratings

    0 ratings0 reviews

    What did you think?

    Tap to rate

    Review must be at least 10 words

      Book preview

      How to Attack and Defend Your Website - Henry Dalziel

      How to Attack and Defend Your Website

      Henry Dalziel

      Table of Contents

      Cover

      Title page

      Copyright

      Author Biography

      Contributing Editor Biography

      Introduction

      Chapter 1: Web Technologies

      Abstract

      1.1. Web servers

      1.2. Client-side versus server-side programming languages

      1.3. JavaScript – what is it?

      1.4. What can JavaScript do?

      1.5. What can JavaScript not do?

      1.6. Databases

      1.7. What about HTML?

      1.8. Web technologies – putting it together

      1.9. Digging deeper

      1.10. Hypertext Transfer Protocol (HTTP)

      1.11. Verbs

      1.12. Special characters and encodings

      1.13. Cookies, sessions, and authentication

      1.14. Short exercise: Linux machine setup

      1.15. Using the Burp Suite intercepting proxy

      1.16. Why is the intercepting proxy important?

      1.17. Short exercise – using the Burp Suite decoder

      1.18. Short exercise – getting comfortable with HTTP and Burp Suite

      1.19. Understanding the application

      1.20. The Burp Suite site map

      1.21. Discovering content and structures

      1.22. Understanding an application

      Chapter 2: Exploitation

      Abstract

      2.1. Bypassing client side controls

      2.2. Bypassing client-side controls – example

      2.3. Bypassing client-side controls – exercise solution

      2.4. SQL injection

      2.5. SQL injection

      2.6. Short Exercise: Pwning with SQLMap

      2.7. Cross-site scripting (XSS)

      2.8. Stored cross-site scripting XSS

      2.9. Short exercise: using stored XSS to deface a website

      Chapter 3: Finding Vulnerabilities

      Abstract

      3.1. The basic process – steps

      3.2. Exercise – finding vulnerabilities

      Copyright

      Syngress is an imprint of Elsevier

      225 Wyman Street, Waltham, MA 02451, USA

      Copyright © 2015 Elsevier Inc. All rights reserved.

      No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier.com/permissions.

      This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein).

      Notices

      Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods, professional practices, or medical treatment may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information, methods, compounds, or experiments described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility.

      To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein.

      British Library Cataloguing-in-Publication Data

      A catalogue record for this book is available from the British Library

      Library of Congress Cataloging-in-Publication Data

      A catalog record for this book is available from the Library of Congress

      ISBN: 978-0-12-802732-5

      For information on all Syngress publications visit our website at http://store.elsevier.com/

      Author Biography

      Henry Dalziel is a serial education entrepreneur, founder of Concise Ac Ltd, online cybersecurity blogger, and e-book author. He writes for the blog "Concise-Courses.com" and has developed numerous cybersecurity continuing education courses and books. Concise Ac Ltd develops and distributes continuing education content (books and courses) for cybersecurity professionals seeking skill enhancement and career

      Enjoying the preview?
      Page 1 of 1