The web application hacker's handbook

This is a practical manual for finding and exploiting security flaws in web applications. It treats each category of vulnerability in turn, using real-world examples, screen shots and code extracts to show how the weakness appears and how an attacker uses it.

The targets are the kinds of application people use every day, including online banking and e-commerce sites. Attacks covered range from getting past login mechanisms and injecting code to abusing flaws in an application's logic and compromising other users. For each kind of weakness, the steps of detection and exploitation are laid out in detail.

The approach rests on a point about the work itself: every web application is different, so attacking one means applying general principles, techniques and experience with some imagination. The book goes further and shows how the most successful hackers automate their bespoke attacks. Its methodology combines human intelligence with computerized brute force, an approach that often produces devastating results.

The authors are professional penetration testers with nearly a decade in web application security, and they have presented training courses at Black Hat conferences around the world. Dafydd Stuttard, under the alias PortSwigger, developed the Burp Suite of web application hack tools. The tone is hands-on and technical, and it suits readers who want to learn how attacks are carried out step by step.