[Help] Web Hacking

[Kiuhnm]

I started my hacking adventure with code exploitation (now I know how to bypass DEP and, when possible, ASLR). Now I think I'll move to cryptography (http://cryptopals.com/) and Web App Hacking.
Where should I start? What about this book?
http://www.amazon.com/The-Web-Application-Hackers-Handbook/dp/1118026470
Also, should I study Javascript, PHP, ASP.NET etc...?

[HTH]

ehhh.. one man's opinion? There is nothing that can be taught in a book that can't be taught via some quick tutorials. At least for Web-Apps, after that its just a matter of practice.

You'll want to look at HTML and CSS (derp)
PHP for Server Side Dynamic Webpages
Javascript for Client Side dynamic Webpages
SQL for database queries, and yes, asp, and ajax, and such will all help you, but the five there are, again, IMO, the biggest/most important things to learn.

There are lots of Tuts in our tutorial section for this sort of thing, tho tbh if you're jumping around from subject tp subject youll probably only need t olook at SQLi and XSS problems :p

[M1lak0]

ehhh.. one man's opinion? There is nothing that can be taught in a book that can't be taught via some quick tutorials. At least for Web-Apps, after that its just a matter of practice.

You'll want to look at HTML and CSS (derp)
PHP for Server Side Dynamic Webpages
Javascript for Client Side dynamic Webpages
SQL for database queries, and yes, asp, and ajax, and such will all help you, but the five there are, again, IMO, the biggest/most important things to learn.

There are lots of Tuts in our tutorial section for this sort of thing, tho tbh if you're jumping around from subject tp subject youll probably only need t olook at SQLi and XSS problems :p

The above things will be effective if you know these labguages.. It'll be really easy for you to graspup the concepts and learn more faster and easier..
There are hell lot of problem you'll face but if you know above things.. You are on a boost.. \m/ Happy hacking..

[Kiuhnm]

I already know HTML, CSS, Dart, PL/SQL (Oracle), MongoDB, redis and I read a book about Javascript and HTML5 a few years ago but then I decided to develop Single Page Applications in Dart (Google's new language).
I kind of hate Javascript with all its idiosyncrasies and oddities so I switched to Dart and don't regret it. Unfortunately, to become a hacker I need to deal with Javascript all over again

[Kiuhnm]

ehhh.. one man's opinion? There is nothing that can be taught in a book that can't be taught via some quick tutorials. At least for Web-Apps, after that its just a matter of practice.

I'm not sure I agree with you on this. That's a 900-page book. I doubt some quick tutorials can offer the same amount of information.

[M1lak0]

I already know HTML, CSS, Dart, PL/SQL (Oracle), MongoDB, redis and I read a book about Javascript and HTML5 a few years ago but then I decided to develop Single Page Applications in Dart (Google's new language).
I kind of hate Javascript with all its idiosyncrasies and oddities so I switched to Dart and don't regret it. Unfortunately, to become a hacker I need to deal with Javascript all over again

JS is just one tiny part..
If so then go ahead with some basic of web app exploitation or try exploiting different attacks..
If you don't know which types of attack there are and how to exploit and patch them I have a useful link for you to move one step forward:
https://www.owasp.org/index.php/Category:Attack
Check this, it has lots of we app attacks, their explanation, patch and exploitation..
Includes mobile based attacks,
Client side attacks,
Encoding, Session flaws, types of db injection, SSI and hell lot of things..
If it helped you +1 please!
hahah Kidding..

[Kiuhnm]

I already know OWASP, but I decided to start with the book. I like to be systematic in my study. I always start with big comprehensive books and then move to tutorials and articles to keep myself up to date.

[M1lak0]

I already know OWASP, but I decided to start with the book. I like to be systematic in my study. I always start with big comprehensive books and then move to tutorials and articles to keep myself up to date.

Ohhhw.. Your wish..!!
By tutorials you will learn more faster! Thats all We are trying to explain..

[Kiuhnm]

Ohhhw.. Your wish..!!
By tutorials you will learn more faster! Thats all We are trying to explain..

I don't see how that's possible. Are you saying that books are full of useless stuff?
Good books are the result of a thorough work of synthesis and reorganization of material that is scattered throughout the Internet or can be found in technical papers. Books are good for mathematics, machine learning, statistics, reverse engineering, etc...
Is Web Application Penetration Testing so different than books become inefficient?
I find it difficult to believe...

[M1lak0]

I don't see how that's possible. Are you saying that books are full of useless stuff?
Good books are the result of a thorough work of synthesis and reorganization of material that is scattered throughout the Internet or can be found in technical papers. Books are good for mathematics, machine learning, statistics, reverse engineering, etc...
Is Web Application Penetration Testing so different than books become inefficient?
I find it difficult to believe...

Well, didnI say books are useless.. Don't take it in a wrong way brother.. I was just trying to give my suggestion.. Take it or leave it.. Don't misunderstand me and take the topic somewhere else.. Thats all..

[lady__godiva]

That book is a really good one in my opinion and it can be considered a good starting point. It's well written and covers a wide variety of topics but remember that it is a book. It is an excellent resource but be sure to make practice as you go on reading it. 900 pages are worth nothing if you do not put what you learnt into practice (legally ofc), also because only by practicing you acquire full awarness and knowledge about that specific technique.

[Kiuhnm]

That book is a really good one in my opinion and it can be considered a good starting point. It's well written and covers a wide variety of topics but remember that it is a book. It is an excellent resource but be sure to make practice as you go on reading it. 900 pages are worth nothing if you do not put what you learnt into practice (legally ofc), also because only by practicing you acquire full awarness and knowledge about that specific technique.

The authors of that book offer a lab full of challenges/exercises. The access to the lab is 7 dollars per hour if I remember correctly. I think that's the easiest way to put what you learn in the book into practice. The main advantage is that you can focus on single topics as you study them in the book as opposed to having to deal with full penetration testing when you're still not ready.
That would be the first time I pay for my education (OK, except for the university) and so I'll leave that as a last resort.
Here are a few resources I could use:
http://www.amanhardikar.com/mindmaps/Practice.html

[lucid]

I'm not sure I agree with you on this. That's a 900-page book. I doubt some quick tutorials can offer the same amount of information.

Quality of information is not measured in the quantity of words.

[lady__godiva]

The authors of that book offer a lab full of challenges/exercises. The access to the lab is 7 dollars per hour if I remember correctly. I think that's the easiest way to put what you learn in the book into practice. The main advantage is that you can focus on single topics as you study them in the book as opposed to having to deal with full penetration testing when you're still not ready.
That would be the first time I pay for my education (OK, except for the university) and so I'll leave that as a last resort.
Here are a few resources I could use:
http://www.amanhardikar.com/mindmaps/Practice.html

True, the lab they provide allows you to experiment a bit, but in the long run 7$/hour can be quite a big amount. Unluckily i don't know many alternatives, there's Hack this site, but personally i don't like it.

[Nortcele]

Go to the Ebooks section, don't buy anything on the Internet.