Climbing Mount WebAppSec

Recently I have become somewhat obsessed with Web Application Security (WebAppSec) sparked in part by coming into contact with Detectify’s Lab blog posts and also the news that the UK – via the NCSC and in tandem with Luta Security – will be running a “Vulnerability Co-ordination Pilot“.

As WebAppSec is a not an field I have devoted any great length of time to in the past, I am starting out on this journey as a relative novice. As such, I have decided to chart my progress and learning for anybody else that may be interested.

I will consider this climb accomplished when I metaphorically plant my flag on the summit with a fitting Bug Bounty from HackerOne.

As I have not yet even reached Mount WebAppSec Base Camp, I am in the process of gathering the necessary tools for this great climb.

My further challenge is that all tools I use will be Open Source. Most notably I will be utilising Zaproxy and blogging my experiences.

As many skilled climbers have gone before me, it is prudent to learn as much as possible from them and have collated a Twitter list called “Webapp & bounty hackers” that I have just made public. I’m sure I will be adding more great folk moving forward.

These are the books I have settled on:

The Web Application Hacker’s Handbook: Finding & exploiting Security Flaws 2nd Edition

OWASP Testing Guide v4

Web Hacking 101 – By Yaworsk

SQL Injection Attacks & Defense

The Browser Hacker’s Handbook

Breaking into Information Security: Learning the Ropes 101 – By ZephrFish

To get your juices flowing, I heartily recommend you start with this talk by Jason Haddix from Def Con 23 entitled: How to Shot Web: Web and mobile hacking in 2015.

After watching this, hop over to Jason’s Bug Hunters Methodology Github Page and absorb the goodness.

Also read the interviews hosted on BugBountyForum. There is a rich vein in this little mine.

That’s it for now.

Next up will be discovering and mapping our climb.