Kali Linux Penetration Testing Bible

CHAPTER 9Web Penetration Testing and Secure Software Development Lifecycle

This topic deserves a chapter by itself because of its importance. These days, most companies have a website or a web application portal that brings in profits. In this chapter, you will mainly learn about the methodology of web application penetration testing and how to use Burp Suite Pro edition.

In the previous chapter, you learned about the most common web vulnerabilities that you will encounter in your engagements. I encourage you to delve deep into the subject by exploring other references (application security books, online courses, and the OWASP website) to understand the rest of the flaws (e.g., server‐side request forgery, open redirect, and much more).

This chapter covers the following topics:

• Web pentesting using Burp Suite Pro
• Web application enumeration tools
• Web application manual pentest checklist
• Secure software development life cycle

Web Enumeration and Exploitation

Burp Suite is an excellent tool to have in your repertoire! It allows you to find tons of web application vulnerabilities, and if you want to be a web penetration tester/bug bounty hunter, then this tool is a must. This section covers the professional edition of Burp Suite, which is not free.

Burp Suite Pro

To summarize this tool in one simple phrase, Burp Suite allows you to use the proxy to intercept and modify the web requests and responses. This tool can scan for web application–based vulnerabilities and much more ...