Next Gen Web Pen Testing
summary
Covers concrete testing tactics for HTTP/2 CORS CSP REST and WebSockets with examples and tool notes rather than theory explains when to downgrade to HTTP/1.1 vs build a custom client shows that Burp records WebSocket history but Repeater/Intruder don’t work so interception must stay on gives exact CORS headers to probe and how CSP can silently block XSS exposes common REST pitfalls including undocumented endpoints and session handling and announces SamuraiWTF 4.0 VM (Ubuntu 16.04 LTS) with added mobile targets and vulnerable examples
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:19Jason Gillam
- 1:47Kevin Johnson
- 4:40Web Applications Have Changed...
- 6:34So has development...
- 8:51We need to adapt!
- 9:58HTTP/2 is a Big Upgrade
- 14:15Testing HTTP/2
- 17:57Testing Websockets
- 24:07What's an "Origin"?
- 25:15SOP Exceptions
- 27:30Fetching a CORS Policy
- 32:46CORS Pentest Considerations
- 38:09Focus on the Client
- 39:42REST Clients
- 41:45Testing Considerations
- 46:10Content Security Policy (CSP)
- 46:29CSP Versions
- 49:22Browser Support
- 53:26Main Differences in 4.0
