From skid to less than skid: Fraq learns to hack webapps

[fraq]

Okay, I’ve spent a while doing security but very little of it focused on web apps. Like, almost none. As a sys admin, I’m more concerned about hardening my OS and learning fun things like buffer overflows and interesting network attacks.

That said, I find myself in a position now where I need to learn a lot more about web apps and learn it fast. I’m going to assume I’m starting from the bottom here and will let you tag along as I explore this area.

There isn’t really any content for this post other than to let y’all know I’ll be talking like a noob for the next few weeks.

First adventure: finding an XSS by accident

Fraq vs. the webapp: Reflective XSS

It’s already time for my first lesson learned. As I mentioned before, even though I have experience here I’m assuming that I’m starting from the bottom. Without further ado, here’s the first thing I discovered: Reflective XSS OWASP explains things so much better than I do, so I’m going to borrow from their page for a bit: Reflected Cross-site Scripting (XSS) occur when an attacker injects browser executable code within a single HTTP response. The injected attack is not stored within the appl…

[oaktree]

Are you going to focus on PHP, JS, what?

[fraq]

The app I’ll be working against is mostly JS

[VVid0w (H@x0r1ng M@573r)]

I’ll be looking forward to seeing how you progress as well as following you along in your journey!

[_py]

Should we expect browser exploit demos later on?

[ricksanchez]

Sounds good. I don’t know much about webapps so i hope to learn a thing or two as well here!

[fraq]

If I get that far

[Kage]

Really good idea, I’ll definitely keep reading your articles, thanks in advance.

[dtm]

Keen. Currently sitting in my first websec lecture.