Learning Kali Linux, 2nd Edition

Chapter 8. Web Application Testing

Think about the applications that you use by way of a web interface. Your banking. Your credit cards. Social networking sites like Facebook, X (Twitter), LinkedIn, and so many others. Job search sites. Your information is stored by a lot of companies with accessible portals available on the open internet. Because of the amount of data that is available and the potentially exposed pathways to that data, web attacks are common vectors. Even mobile applications today are probably interacting with a web-based backend, probably at a cloud service provider. As a result, web application testing is a common request from companies. At times, you will find that web application testing may be all that you are asked to do.

Kali, not surprisingly, is loaded with web application testing tools. To make effective use of them, though, it’s helpful to understand what you are up against. This includes understanding the potential targets in order to better identify the risk. It also includes knowing the potential architecture you may be looking at—the systems you may need to pass through and the way they may be arranged, including the security mechanisms that may be in place to protect the elements of the application.

Web Architecture

A web application is a way of delivering programmatic functionality using common web-based technologies between a server and a client. The client has commonly been a web browser, though you may find that a web application can be used ...