The Web Application Hacker's Handbook: First Edition

by Marcus Pinto & Dafydd Stuttard

The first edition of The Web Application Hacker's Handbook established the standard methodology for web application penetration testing. Written by Dafydd Stuttard, the creator of Burp Suite, the book provides systematic approaches to discovering and exploiting every class of web vulnerability. It covers authentication flaws, session management weaknesses, access control bypasses, injection attacks (SQL, OS command, LDAP, XPath), cross-site scripting, cross-site request forgery, and logic flaws. The methodology walks through the complete assessment process from mapping the application and analyzing its functionality to testing each attack surface and exploiting discovered vulnerabilities. Despite being superseded by the second edition, the first edition remains valuable for its foundational treatment of web security concepts.