Insecure error handling can lead to very severe consequences and that’s the reason why this subject is interesting for penetration testers. In this course, Web Application Penetration Testing: Insecure Error Handling, you will learn how to test for insecure error handling in modern web applications. First, you will discover different types of insecure web server errors. You will see what dangers can happen when the web server version is disclosed in an error message. You will also see how the attacker can steal sensitive data as a result of a cross-site scripting attack via an error message. Next, you will learn about insecure error handling in the context of login functionality, which is one of most sensitive functionalities in web applications. You will see how to test for user enumeration via error messages and how to test for insecure handling of many unsuccessful login attempts. Finally, you will explore some of the most dangerous errors in modern web applications (unhandled exceptions and file inclusion errors). You will see how the attacker can learn sensitive data as a result of triggering an unhandled exception. You will also see how the attacker can proceed from file inclusion errors to reading the content of sensitive files. By the end of this course, you will know how to test for insecure error handling in modern web applications and how to prevent these problems from happening.
Author Name: Dawid Czagan
Author Description:
Dawid Czagan is listed among the Top 10 Hackers by HackerOne. He has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter, and other companies. Due to the severity of these bugs, he has received numerous awards for his findings. He has delivered security training courses at key industry conferences, such as Hack In The Box, CanSecWest, 44CON, Hack In Paris, DeepSec, BruCON, and for many corporate clients. His students include security specialists from Oracle, Adobe, Red H… more

Table of Contents

• Course Overview
  2mins
• Triggering Web Server Errors
  15mins
• Identifying Login Functionality Errors
  17mins
• Finding Unhandled Exceptions and File Inclusion Errors
  14mins