# 2 - Web Application Penetration Testing

#### Topics

> 1. [Web App Concepts](web-app-security/5.1-web-app-concepts)
> 2. [Information Gathering](web-app-security/5.2-information-gathering)
> 3. [Cross Site Scripting](web-app-security/5.3-cross-site-scripting)
> 4. [SQL Injection](web-app-security/5.4-sql-injection)
> 5. [Other Common Web Attacks](web-app-security/5.5-other-common-web-attacks)

## Web Basics

* ​[Web Application Basics](https://attackdefense.com/listing?labtype=webapp-web-app-basics\&subtype=webapp-web-app-basics-getting-started)​
* ​[Web Apps Tools of Trade](https://attackdefense.com/listing?labtype=webapp-tools-of-trade\&subtype=webapp-tools-of-trade-getting-started)

## Practise

🔬 There are many vulnerable testing web apps like:

* ​[Juice Shop - Kali Install](https://www.kali.org/tools/juice-shop/)​
* ​[DVWA - Kali Install](https://www.kali.org/tools/dvwa/)​
* ​[bWAPP](http://www.itsecgames.com/)​
* ​[Mutillidae II](https://github.com/webpwnized/mutillidae)

### DVWA

**The Damn Vulnerable Web Application (DVWA)** is a web application built with PHP and MySQL intentionally designed to be susceptible to security vulnerabilities. Its primary purpose is to serve as a resource for security professionals to assess their skills and tools within a legal context. Additionally, it aids web developers in gaining a deeper understanding of the processes involved in securing web applications and facilitates learning about web application security for both students and teachers in a controlled classroom setting.

DVWA is designed to provide a platform for practicing various common web vulnerabilities at different difficulty levels, all presented through a simple and user-friendly interface. It's important to note that there are deliberate both documented and undocumented vulnerabilities within the software, encouraging users to explore and identify as many issues as possible.

{% embed url="https://github.com/digininja/DVWA" %}

#### DVWA - My Writeups

{% content-ref url="https://app.gitbook.com/s/rRWtuMw6xkkeDjZfkcWC/dvwa" %}
[DVWA](https://app.gitbook.com/s/rRWtuMw6xkkeDjZfkcWC/dvwa)
{% endcontent-ref %}

## Other Resources

* [eWPTv2 Notes](https://dev-angelist.gitbook.io/ewptv2-notes)
* [WAPT Notes](broken-reference)

## Theory and Lab platform

{% embed url="https://portswigger.net/web-security/all-labs" %}

{% hint style="danger" %}
#### ❗ Disclaimer

* **Never use tools and techniques on real IP addresses, hosts or networks without proper authorization!**
{% endhint %}
