Next Gen Web Pen Testing - Handling Modern Applications in a Penetration Test
Python, Prompt Engineering, Data Science — Build the Skills Employers Want Now
Start speaking a new language. It’s just 3 weeks away.
Overview
Google, IBM & Meta Certificates — All 10,000+ Courses at 40% Off
One annual plan covers every course and certificate on Coursera. 40% off for a limited time.
Get Full Access
Explore next-generation web penetration testing techniques for modern applications in this 58-minute conference talk from AppSecUSA 2016. Discover how to adapt testing methods to handle new technologies like HTTP/2, WebSockets, CORS, RESTful APIs, and Content Security Policy (CSP). Learn about the nuances of these advancements and their impact on security testing from industry experts Kevin Johnson and Jason Gillam. Gain insights into testing considerations for each technology, including client-side focus and browser support. Understand the evolution of web applications and development practices, and how penetration testing must evolve to keep pace. Conclude with an introduction to the new modern vulnerable application and the release of SamuraiWTF 4.0, providing practical tools for implementing these advanced testing techniques.
Syllabus
Intro
Jason Gillam
Kevin Johnson
Web Applications Have Changed...
So has development...
We need to adapt!
HTTP/2 is a Big Upgrade
Testing HTTP/2
Testing Websockets
What's an "Origin"?
SOP Exceptions
Fetching a CORS Policy
CORS Pentest Considerations
Focus on the Client
REST Clients
Testing Considerations
Content Security Policy (CSP)
CSP Versions
Browser Support
Main Differences in 4.0
Taught by
OWASP Foundation