Results 1 to 8 of 8

Thread: Web application pen-test books?

  1. August 25th, 2005, 06:12 PM #1
    ric-o
    ric-o is offline
    oldie ric-o's Avatar
    Join Date
    Nov 2002
    Posts
    486

    Web application pen-test books?

    Anyone recommend a good web application penetration test books? I've been tasked with doing a bunch of pen-tests against websites lately.

    I have 2 currently:
    _Hacking Exposed Web Applications_ by Joel Scambray and Mike Shema
    _Web Hacking: Attacks and Defense_ by McClure, Shah, Shah

    Any others I should look at? Thanks in advance.
    Reply With Quote Reply With Quote
  2. August 25th, 2005, 07:40 PM #2
    Soda_Popinsky
    Soda_Popinsky is offline
    Join Date
    Nov 2003
    Posts
    1,426
    http://www.owasp.org/documentation/guide.html
    Reply With Quote Reply With Quote
  3. August 25th, 2005, 09:32 PM #3
    Riot
    Riot is offline
    Senior Member
    Join Date
    Jun 2004
    Posts
    379
    The best tutorial on the web
    Reply With Quote Reply With Quote
  4. August 26th, 2005, 04:05 AM #4
    ric-o
    ric-o is offline
    oldie ric-o's Avatar
    Join Date
    Nov 2002
    Posts
    486
    Soda:

    Yep, know that site pretty well: been frequent visitor for last 1.5 years - have all their guides. Also have several docs written by SPIDynamics too.

    Riot:

    Brown noser. ha ha. Yep, been to his site a few times.

    Thanks guys. FYI: I just ordered _HackNotes: Web Security Pocket Guide_ as well as a book published by Wiley called _Testing Web Applications_.
    Reply With Quote Reply With Quote
  5. August 26th, 2005, 04:35 AM #5
    zencoder
    zencoder is offline
    AO Senior Cow-beller
    Moderator     zencoder's Avatar
    Join Date
    Dec 2004
    Location
    Mountain standard tribe.
    Posts
    1,177
    ric-o hit it. SPIDynamics makes some of the better commercially available software for web app testing. Anything by them would be top of my list.
    "Data is not necessarily information. Information does not necessarily lead to knowledge. And knowledge is not always sufficient to discover truth and breed wisdom." --Spaf
    Anyone who is capable of getting themselves made president should on no account be allowed to do the job. --Douglas Adams (1952-2001)
    "...people find it far easier to forgive others for being wrong than being right." - Albus Percival Wulfric Brian Dumbledore
    Reply With Quote Reply With Quote
  6. August 26th, 2005, 10:12 AM #6
    Aspman
    Aspman is offline
    Frustrated Mad Scientist
    Join Date
    Dec 2004
    Posts
    1,152
    Network Security Assessment

    <edit>Oops, not web application specific but might be useful.
    Sheep Rustlin\' Taz Chairman
    Reply With Quote Reply With Quote
  7. August 26th, 2005, 03:12 PM #7
    Riot
    Riot is offline
    Senior Member
    Join Date
    Jun 2004
    Posts
    379
    here you can find some great book here http://ebook.irdesigner.com/
    Reply With Quote Reply With Quote
  8. August 26th, 2005, 08:25 PM #8
    R0n1n
    R0n1n is offline
    Senior Member
    Join Date
    Oct 2002
    Posts
    314
    There is a good book called application security, or web app security, which has a picture of a cowboy hat on the front...can`t remember what the bloody name is at the moment.

    I think if you already have a couple of books then you can stick with those and just read the papers from SPI, NGS etc...

    Also, have a look at WebGoat http://www.owasp.org/software/webgoat.html as you can learn alot form there.
    Quis custodiet ipsos custodes
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules