{"id":206,"date":"2009-03-23T16:00:50","date_gmt":"2009-03-23T21:00:50","guid":{"rendered":"http:\/\/www.webadminblog.com\/?p=206"},"modified":"2009-04-01T10:33:29","modified_gmt":"2009-04-01T15:33:29","slug":"assessing-your-web-app-manually-without-hacking-it","status":"publish","type":"post","link":"https:\/\/www.webadminblog.com\/index.php\/2009\/03\/23\/assessing-your-web-app-manually-without-hacking-it\/","title":{"rendered":"Assessing Your Web App Manually Without Hacking It"},"content":{"rendered":"
After giving my presentation on “Using Proxies to Secure Applications and More” at the TRISC 2009 conference, I decided to attend the presentation by Robert “RSnake” Hansen and Rob MacDougal entitled “Assessing Your Web App Manually Without Hacking It”.\u00a0 The gist of this presentation was that with a few simple tools (Web Developer Toolbar, NoScript, you web browser) you can spend about an hour looking at the characteristics of a web application in order to determine what types and how many vulnerabilities it may have.\u00a0 My notes on the presentation are below:<\/p>\n
\nStep 1: Exploit Overachievers<\/p>\n
\n
Maximize value by using free tools<\/li>\n
OWASP (Open Web Application Security Project)<\/li>\n
Security is not an arcane art reserved for people with a special gift.\u00a0 It\u2019s campfire knowledge.\n
\n
Assess your security posture regularly<\/li>\n
Do not neglect any aspect of your security; bad guys don\u2019t (Social Engineering, Internal Network, Firewall, Web Apps, etc)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Step 3: Chase Your Tail<\/p>\n
\n
Remember where you started\n
\n
Free tools can provide extreme amounts of value\n
\n
OWASP (Eg: OWASP Testing Guide)<\/li>\n
WASC<\/li>\n<\/ul>\n<\/li>\n
There is no magic to security<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Alternate paths of exploitation (email, FTP, APIs, etc)<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
After giving my presentation on “Using Proxies to Secure Applications and More” at the TRISC 2009 conference, I decided to attend the presentation by Robert “RSnake” Hansen and Rob MacDougal entitled “Assessing Your Web App Manually Without Hacking It”.\u00a0 The gist of this presentation was that with a few simple tools (Web Developer Toolbar, NoScript, […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[222],"tags":[229,76,230,228,158,159,102],"class_list":["post-206","post","type-post","status-publish","format-standard","hentry","category-texas-regional-infrastructure-security-conference-2009","tag-app","tag-application","tag-assessment","tag-manual","tag-penetration","tag-testing","tag-web"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t