the-web-application-hackers-handbook

CHAPTER
20
A Web Application
Hacker’s Toolkit
Some attacks on web applications can be performed using only a standard web
browser; however, the majority of them require you to use some additional tools.
Many of these tools operate in conjunction with the browser, either as extensions
that modify the browser’s own functionality, or as external tools that run
alongside the browser and modify its interaction with the target application.
The most important item in your toolkit falls into this latter category. It operates
as an intercepting web proxy, enabling you to view and modify all the
HTTP messages passing between your browser and the target application. Over
the years, basic intercepting proxies have evolved into powerful integrated tool
suites containing numerous other functions designed to help you attack web
applications. This chapter examines how these tools work and describes how
you can best use their functionality.
The second main category of tool is the standalone web application scanner.
This product is designed to automate many of the tasks involved in attacking a
web application, from initial mapping to probing for vulnerabilities. This chapter
examines the inherent strengths and weaknesses of standalone web application
scanners and briefly looks at some current tools in this area.
Finally, numerous smaller tools are designed to perform specific tasks when
testing web applications. Although you may use these tools only occasionally,
they can prove extremely useful in particular situations.
747