Web App Hacking

Web App Testing Resources

Guides

• OWASP Web Security Testing Guide - comprehensive guide to testing the security of web applications and web services created by the OWASP foundation.

  • https://owasp.org/www-project-top-ten/ - Guide to the top ten most common vulnerabilities encountered in web app pentesting.

  • OWASP Testing Guide 4.0 (PDF)

  • https://www.crest-approved.org/membership/crest-ovs-programme/ - CREST's New application secuyrity standard built with OWASP AVS.

• Hacktricks Web Pentesting Guide - Written by Carlos Pollop, the creator of WinPEAS and LinPEAS. Everything this guy makes is gold. Highest of recommendations

• The Bug Hunters Methodology - Written by the Jason Haddix, this repo details his toolset and methodology for web app penetration testing.

  • Jason's Presentation of TBHM 2.0

  • Updated info of TBHM 4.02

• HowToHunt - Amazing collaborative project documenting testing methodology for different web application vulnerabilities.

• https://kathan19.gitbook.io/howtohunt/checklist/web-application-pentesting-checklist

• https://alike-lantern-72d.notion.site/Web-Application-Penetration-Testing-Checklist-4792d95add7d4ffd85dd50a5f50659c6

• https://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Checklist_by_Chintan_Gurjar.pdf

• https://github.com/KathanP19/HowToHunt/blob/master/CheckList/mindmap.png

• https://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Penetration_Testing_Methodology%402x.png

• https://github.com/jassics/security-study-plan/blob/main/web-pentest-study-plan.md

Resources

Resource Collections

Bug Bounty

Platforms

Platforms

• https://www.hackerone.com/

• https://www.bugcrowd.com/

  • https://bugcrowd.com/programs/organizations/cisa

• https://www.synack.com/

• https://cobalt.io/

• https://www.intigriti.com

• https://www.zerocopter.com/

• https://www.yeswehack.com/

• https://www.antihack.me/

• https://securebug.se/

• https://www.openbugbounty.org/

• https://security.apple.com/

Resources and Reference

Web Technologies

Web Technologies

Attacks and Vulnerabilities

Web App Vulnerabilities

Training and Resources

For resources including offensive security courses, books, CTFs and much more, please check out the Training and Resources section of this guide.

• https://tryhackme.com/module/intro-to-web-hacking

• crAPI - completely ridiculous API (crAPI) will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself.

Training and Resources