mccabe615

#!/usr/bin/env ruby


# encoding: BINARY
require 'socket'
require 'timeout'
require 'openssl'

module ContentType
  ALERT = "\x15"

mccabe615

#!/usr/bin/env ruby

# encoding: BINARY
require 'socket'
require 'timeout'
require 'openssl'

module ContentType
  ALERT = "\x15"
  HEARTBEAT = "\x18"

mccabe615

The Web Application Hacker's Handbook

Web Application Hacker's Handbook Task checklist as a Github-Flavored Markdown file

Contents

• Recon and analysis
• Test handling of access
• Test handling of input
• Test application logic
• Assess application hosting
• Miscellaneous tests

mccabe615

Strict-Transport-Security: max-age:31536000; includeSubDomains

mccabe615

<IfModule mod_headers.c>
 # this domain should only be contacted in HTTPS for the next 6 months
 Header add Strict-Transport-Security "max-age=15768000"
</IfModule>

mccabe615

Gellers-MacBook-Pro:HSTS $ curl -si nvisium.com | grep ^Strict
Strict-Transport-Security: max-age=31536000

mccabe615

 add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";

mccabe615

config.force_ssl = true

mccabe615

The Web Application Hacker's Handbook

Web Application Hacker's Handbook Task checklist as a Github-Flavored Markdown file

Contents

• Recon and analysis
• Test handling of access
• Test handling of input
• Test application logic
• Assess application hosting
• Miscellaneous tests

mccabe615

worker_processes 1;
user nobody nogroup;
pid /tmp/nginx.pid;
error_log /var/log/nginx.error.log;
events {
  worker_connections 1024;
  accept_mutex off;
}

http {