The web application hacker's handbook
by Dafydd Stuttard, Marcus Pinto · first published 2007
63% recommend35% neutral2% critical
Why HN recommends it
Thorough walkthrough of web vulnerability classes like SQL injection, command injection and XSS, paired with hands-on practice using Burp Suite. Suits aspiring and working web security testers.
Summarised by Claude from recommending comments
This book is a practical guide to discovering and exploiting security flaws in web applications. The authors explain each category of vulnerability using real-world examples, screen shots and code extracts. The book is extremely practical in focus, and describes in detail the steps involved in detecting and exploiting each kind of security weakness found within a variety of applications such as online banking, e-commerce and other web applications. The topics covered include bypassing login mechanisms, injecting code, exploiting logic flaws and compromising other users. Because every web app
Affiliate links. As an Amazon Associate I earn from qualifying purchases.
Mentions per year
What Hacker News says
Related books
2008–2025The art of software security assessment
Mark Dowd, John McDonald, Justin Schuh
Recommended by 21 · mentioned by 3121 recommend · 31 mention21 recommend · 3121 recommend
2013–2017A tangled web
Lucy Maud Montgomery
Recommended by 2 · mentioned by 22 recommend · 2 mention2 recommend · 22 recommend
2011–2024The tangled Web
Michal Zalewski
Recommended by 32 · mentioned by 3832 recommend · 38 mention32 recommend · 3832 recommend
2016–2023The Browser Hacker's Handbook
Wade Alcorn, Christian Frichot, Michele Orru
Recommended by 2 · mentioned by 32 recommend · 3 mention2 recommend · 32 recommend
2009–2017Gray hat Python
Justin Seitz
Recommended by 5 · mentioned by 85 recommend · 8 mention5 recommend · 85 recommend
2009–2020The shellcoder's handbook
Chris Anley, John Heasman, Felix Linder, Gerardo Richarte
Recommended by 8 · mentioned by 98 recommend · 9 mention8 recommend · 98 recommend
Securing DevOps
Julien Vehent
Recommended by 1 · mentioned by 31 recommend · 3 mention1 recommend · 31 recommend
So, I've read most of these. Here's a tour of what is definitely useful and what you should probably avoid. _________________ Do Read: 1. The Web Application Hacker's Handbook - It's beginning to show its age, but this is still absolutely the first book I'd point anyone to for learning practical application security. 2. Practical Reverse Engineering - Yep, this is great. As…
on “Cybersecurity Humble Book Bundle” ↗…certifications at all. 1. Learn to code. C + Python is a great choice, to start with (or C + Ruby). 2. Start with application security, because it's the easiest place to get your feet wet. 3. Work through The Web Application Hacker's Handbook (don't just read it). 4. Find bug bounties in as many programs on BugCrowd or HackerOne as you can. Extra resume points (and money!) for bug bounties in Google, Facebook etc. 5. Join a reputable security…
on “Careers in security, ethical hacking and advice on where to get started” ↗A mediocre, haphazardly put together cheat sheet with often application-specific examples. Pick up The Web Application Hacker's Handbook instead, or read the OWASP Testing Guide.
on “Web Hacking 101 [pdf]” ↗I would agree. Some of the books I'd highly recommend for anyone looking to be a well-rounded hacker: * TCP/IP Illiustrated (Volumes 1,2 & 3) - W. Richard Stephens * The Web Application Hacker's Handbook - Stuttard, Pinto et al * The Shellcoder's Handbook - Kozoil, Aitel et al * The Cuckoo's Egg - Clifford Stoll * Neuromancer - William Gibson * ARM System-on-chip Architecture - Stephen B. Furber *…
on “The Hacker's Path” ↗…are well deserved. For those of you who would like to try and earn bounties like these, I recommend the same books I always do: 1. The Art of Software Security Assessment 2. Gray Hat Python 3. The Web Application Hacker's Handbook This is your ethical hacker starter kit. The first two are good for foundational knowledge and will show you how to find the bugs worth something. The third book is specialized for web applications,…
on “$9000 bounty paid for Python bugs” ↗I like Dafydd Stuttard's "The Web Application Hacker's Handbook", despite the title. Work through the examples. A lot of people will direct you to OWASP, which is not a bad free tertiary source (owasp.org). There's lots of HOWTO stuff there. Be careful about the…
on “Ask HN: Primer on Web Security” ↗…speak ill of any specific company, but firms like Accuvant, Matasano and iSec should usually be your first attempt to break in. They are receptive to developers with no security experience. Pick up The Web Application Hacker's Handbook (showing its age a little now, but still the only book you need to start in web app security) and read through it. Other firms sometimes have you do ridiculous amounts of travel (75%+) without informing…
on “A Career in Science Will Cost You Your Firstborn” ↗To add some color to this great suggestion - The Web Application Hacker's Handbook is a better resource for learning to break web applications than for learning to build them properly. It will teach you every about almost every vulnerability that can be classified and how to find it.…
on “Ask HN: Best resources on webapp security?” ↗Glad you asked. This is a list I like to call, "how to become an extremely effective and formidable security engineer." 1. The Web Application Hacker's Handbook Probably the first book you want to read; this will teach you the core mindset you need for finding security flaws in web applications as well as give a very strong foundation for the different classes…
on “Ask HN: What are the best books for learning information security?” ↗…constant hoard of people outside the industry who believe web application bugs are worth anything on the black market. For anyone who would like to replicate this success, know the following: 1. The Web Application Hacker's Handbook is your friend. It's outdated but it's still the best foundation. Follow it up with The Browser Hacker's Handbook or The Mobile Application Hacker's Handbook. 2. You can optimize for exotic vulnerabilities…
on “High frequency security bug hunting: 120 days, 120 bugs” ↗For anyone who's after a book: I've found Dafydd Stuttard and Marcus Pinto's "The Web Application Hacker's Handbook" to be invaluable.
on “Learn Web Penetration Testing The Right Way” ↗…https://www.pluralsight.com/ The entry level cert in this area is the CEH. It's kind of looked down upon, like a lot of entry level certs are, but studying/working towards that isn't a bad thing. Books: - Practical: The Web Application Hacker's Handbook 2nd Edition - Gives a very good overview and is a good place to start. The Hacker Playbook 3: Practical Guide To Penetration Testing - #3 just came out. Haven't gone through my copy yet, but I've heard…
on “Ask HN: What are the best resources for learning security and pen testing?” ↗…since it spends much more time on browsers and browser technology than it does on the serverside issues (like SQL databases and authorization systems) that dominate web appsec. At Matasano, we gave The Web Application Hacker's Handbook to candidates to cover that gap.
on “The Tangled Web: A Guide to Securing Modern Web Applications (2011)” ↗Try searching for a pdf of the "Web Application Hacker's Handbook".
on “Ask HN: Best online resources for learning web security” ↗For PHP: PHP and MySQL Web Development, 4th Edition by Welling and Thomson. Learn about PDO and parameterized queries and such from the online docs; the book treats security poorly. The Web Application Hacker's Handbook would probably be a nice third book if you're feeling indulgent. For JS: JavaScript: The Definitive Guide, 5th Edition by Flanagan. Until Secrets of the JS Ninja (or the Rhino book's 6th edition) comes…
on “JavaScript Things I Wish I Knew Much Earlier In My Career” ↗