Next Gen Web Pen Testing - Handling Modern Applications in a Penetration Test

Explore next-generation web penetration testing techniques for modern applications in this 58-minute conference talk from AppSecUSA 2016. Discover how to adapt testing methods to handle new technologies like HTTP/2, WebSockets, CORS, RESTful APIs, and Content Security Policy (CSP). Learn about the nuances of these advancements and their impact on security testing from industry experts Kevin Johnson and Jason Gillam. Gain insights into testing considerations for each technology, including client-side focus and browser support. Understand the evolution of web applications and development practices, and how penetration testing must evolve to keep pace. Conclude with an introduction to the new modern vulnerable application and the release of SamuraiWTF 4.0, providing practical tools for implementing these advanced testing techniques.

Intro
Jason Gillam
Kevin Johnson
Web Applications Have Changed...
So has development...
We need to adapt!
HTTP/2 is a Big Upgrade
Testing HTTP/2
Testing Websockets
What's an "Origin"?
SOP Exceptions
Fetching a CORS Policy
CORS Pentest Considerations
Focus on the Client
REST Clients
Testing Considerations
Content Security Policy (CSP)
CSP Versions
Browser Support
Main Differences in 4.0