Wstg: Web app security testing with browser dev tools

[Abhi-M]

In the following document, I have outlined techniques for using dev tools on popular browsers to perform some web app security tests - getmantra.com/web-app-security-testing-with-browser.

Why?

• Developers are more likely to be familiar with browser dev tools instead of proxies. So, it is better to use browser dev tools for demonstrating web app security issues.
• If someone needs to perform basic web app security testing in limited environments where they can't install or run any tools, these techniques would be helpful

I believe this would be an excellent addition to WSTG.

[kingthorin]

Well it would either have to be added an an appendix, or broken up and fit into the proper sections.

We do already have some coverage for cache, cookies, and localstorage with regard to devtools but it could probably be improved.

[ThunderSon]

That was my same thought. It could fit as an appendix, as it is a quick guide to do it. Breaking it down into the sections could be done, but I still find value in having it on its own. Lots of people search on how to simply do tests using browsers and that could help.

[rejahrehim]

Adding detailed section in Appendix and linking those sections to appropriate chapter section will be a good option.

[kingthorin]

@Abhi-M are you up for tackling this and adding it as an appendix?

[Abhi-M]

Sure. I will add it to the appendix. Thanks.

[kingthorin]

I haven't watched this yet but you might be interested in it and there might be some tidbits worth adding or maybe just include it as a reference. The BHIS guys tend to know their stuff so I figured it couldn't hurt to pass along: https://www.blackhillsinfosec.com/webcast-free-tools-how-to-use-developer-tools-and-javascript-in-webapp-pentests/

[github-actions[bot]]

Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.

[kingthorin]

On it!