Browse the Knowledge Hub211 resources
The Web Application Hacker's Handbook: is it worth reading?
The methodical reference for finding web application vulnerabilities, written by the authors of Burp Suite.
We earn nothing from any link on this page. No affiliate links anywhere in this library.
- published
- 2011
- key ideas
- 3
The Web Application Hacker's Handbook
Finding and Exploiting Security Flaws
by Dafydd Stuttard, Marcus Pinto
- Publisher
- Wiley
- Year
- 2011
- Edition
- Second edition. Dated in specifics but still the standard reference.
- ISBN
- 9781118026472
Useful when you are: Practising tester, Senior / lead
Verdict
Should you read it?
Read it if
You want to add meaningful security testing to functional work without becoming a specialist. The access control chapters alone justify it.
Skip it if
You need current guidance on modern JavaScript application security, API-specific attacks or cloud misconfiguration. The book predates most of it.
The argument
What it argues
A systematic methodology for assessing a web application: mapping the attack surface, then working through authentication, session management, access control, input handling, application logic and infrastructure in turn.
The most useful material for a functional tester is access control and application logic. Broken access control, where changing an identifier exposes another user data, is consistently the most common serious finding and is squarely within functional testing reach rather than requiring a security specialist.
Written by the creators of Burp Suite, so the tooling discussion is authoritative.
Key ideas
Ideas worth taking from it
- 01
Attack surface mapping
Systematically enumerate every entry point before testing any of them. The step that distinguishes methodical assessment from poking at the login form.
- 02
Broken access control
Testing what a user can reach rather than what they can do. Substituting identifiers while authenticated as someone else is the single highest-value security test a functional tester can run.
- 03
Client-side controls are not controls
Anything enforced only in the browser is advisory. Every validation and limit must be verified server side, which is a functional testing concern as much as a security one.
Criticism
What has dated, and what it gets wrong
The second edition is from 2011 and it shows. It predates the single-page application era, modern API design, JWT-based authentication and cloud-native attack surfaces. The methodology holds up well; many specific techniques do not. Pair it with the current OWASP materials rather than relying on it alone.
Keep reading
What to read next
Reading about quality is cheaper than learning it in production.
QAble runs QA for products in BFSI, gaming, healthcare and SaaS, with engineers who have read these and argued about them. Start with a free QA audit.