WAHH

Is WAHH still a worthwhile read for someone trying to break into /sec/? It's nearly 8 years since it came out (2nd ed), how much is still relevant? Will I be able to break and exploit modern webapps if I read it and practice?

yes, most of the vulns inside are still owasps top 10

>>6902 Yes Web Application Hackers Handbook is still a worthwhile read for someone wanting to learn web application security. Also relevant is the OWASP Testing Guide, attached. Even at 8 years old, WAHH is still mostly relevant, because of the fact that specific types of attacks are just examples of a more generic approach and that generic approach still affects a significant number of vulnerable web applications. The book itself actually answers your question in the What is new in this edition section, including a chapter breakdown. Chapters that haven't aged that well include Chapter 3 , which describes underlying web technologies makes no mention of HTTP 2.0 e.g QUIC, and describes web services as mostly SOAP, though they are more likely to be HTTP REST these days. It also doesn't cover TLS / SSL downgrade attacks, whilst it mentions MITM , it doesn't feature it or CDN resource hijacking or software repository dependency injection (particularly common with stuff from npm) either. The other chapters are mostly fine. You will still be able to exploit modern web applications if you read it and practice their exercises or examples. A nice video summary of the changes in OWASP Top 10 from 2013 to 2017 is available from https://www.youtube.com/watch?v=k12u-76CarE and is called Beyond the OWASP Top 10 - Modern web application bugs - NDC Security 2018.

>>6902 Everything there is structured and it's not only about relevance of the vulns, but systematics and approaches of pentesting. As a webdev got surprised myself with some stuff from it.

https://lainchan.org/sec/res/4243.html