Application Penetration Testing – DOs and DON‘Ts
summary
Covers practical web application penetration testing: defines pentesting, who performs it, and how to run efficient tests using common methods and hacks to speed up work. Discusses environment choice (Dev/Stage/Prod), timing, role/rights testing strategies, limitations of OWASP Top 10 for pentests, CAPTCHA challenges, testing with/without WAF, and horizontal vs. vertical privilege escalation, based on 20 years’ experience across hundreds of web apps.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:23What is a penetration test?
- 8:41Penetration test vs attacks
- 16:46Timebox and documentation
- 23:01Application review and risks
- 33:54Test environment and stakeholders
- 40:15Technical review and role rights
- 47:26Q&A
related talks
23mWeb Application Security - owasp top 10 vulnerabilities
33mWorking with penetration testers as a developer
56mBuilding An Effective Application Penetration Testing Team
20mMaking Penetration Tests Actually Useful
44mApplication Security: Everything we know is wrong
50mThe Practicalities of Pen Testing at Scale
19mPenetration Testing
46mHow to perform security testing of a Web application