Hacking Web App Security
As part of Bob Allen's Code Craftman Saturdays, we had Shanti Suresh present a hands on workshop at Pillar Technology's Forge 4.0 location in Ann Arbor.
Her class shed some light onto what cool computer hackers mean when they say they are going to hack into a system.
For this workshop, which ran 5 keyboard hours we started with an introduction to the different terms such as
Phase 1 : Introduction to security
Her class shed some light onto what cool computer hackers mean when they say they are going to hack into a system.
 |
| Bob Allen and Shanti Suresh |
For this workshop, which ran 5 keyboard hours we started with an introduction to the different terms such as
Phase 1 : Introduction to security
Shanti spoke about when and why security became an important aspect of application development and gave a brief overview of the following.
- Security
- Authentication
- Authorization
Next we got down and dirty.
Phase 2 : Setting up with Zap
Using primarily two tools, WebGoat 6.0.1 and Zap (beware of using Zap... it makes your computer vulnerable when connected to an external network or internet) we were able to do some sql injection and bypass security.
We setup Zap to intercept traffic both to and from the server such as
Phase 3 : Hacking Requests and Responses
The exercises involved deep dives into the following :
- Cross site scripting where you redirect the content from WebGoat to another url.
- XSS flaws and how we can try to detect them.
- Hijacking the user's current session
Comments
Post a Comment