Penetration Tester's Open Source Toolkit, 2nd Edition

Chapter 4. Web Server and Web Application Testing

Solutions in this chapter:

• Introduction

• Approach

• Core Technologies

• Open Source Tools

• Case Studies: The Tools in Action

Objectives

This chapter covers port 80. A responsive port 80 (or 443) raises several questions for attackers and penetration testers:

• Can I compromise the Web server due to vulnerabilities on the server daemon itself?

• Can I compromise the Web server due to its unhardened state?

• Can I compromise the application running on the Web server due to vulnerabilities within the application?

• Can I compromise the Web server due to vulnerabilities within the application?

Introduction

This chapter explains how a penetration tester would most likely answer each of the preceding questions.

Attacking or assessing ...