Learning Python Web Penetration Testing: Automate Web Penetration Testing Activities Using Python

Chapter 5: Password Testing; How password attacks work; Password cracking; Password policies and account locking; Our first password BruteForcer; Basic authentication; Creating the password cracker; Adding support for digest authentication; What is digest authentication?; Adding digest authentication to our script; Form-based authentication; Form-based authentication overview; Summary; Chapter 6: Detecting and Exploiting SQL Injection Vulnerabilities; Introduction to SQL injection; SQLi versus blind SQLi; Detecting SQL injection issues; Methods for detecting SQLi.

This book will walk you through the web application penetration testing methodology, showing you how to write your own tools with Python for every main activity in the process. It will show you how to test for security vulnerabilities in web applications just like security professionals and hackers do.

Cover; Title Page; Copyright and Credits; Packt Upsell; Contributor; Table of Contents; Preface; Chapter 1: Introduction to Web Application Penetration Testing; Understanding the web application penetration testing process; Typical web application toolkit; HTTP Proxy; Crawlers and spiders; Vulnerability scanners; Brute forces/predictable resource locators; Specific task tools; Testing environment; Summary; Chapter 2: Interacting with Web Applications; HTTP protocol basics; What is HTTP and how it works?; Anatomy of an HTTP request; HTTP headers; GET request.

Interacting with a web app using the requests libraryRequests library; Our first script; Setting headers; Analyzing HTTP responses; HTTP codes; Summary; Chapter 3: Web Crawling with Scrapy -- Mapping the Application; Web application mapping; Creating our own crawler/spider with Scrapy; Starting with Scrapy; Making our crawler recursive; Scraping interesting stuff; Summary; Chapter 4: Resources Discovery; What is resource discovery?; Building our first BruteForcer ; Analysing the results; Adding more information; Entering the hash of the response content; Taking screenshots of the findings.

Automating the detectionExploiting …