“Military tactics are like unto water; for water in it’s natural course runs away from high places and hastens downwards.

So in war, the way is to avoid what is strong and to strike at what is weak.” – Sun Tzu – On The Art of War, emphasizing the effectiveness of attacking the point of least resistance.

Welcome to the fourth article in the “The Neophyte Web Developer’s Guide to practical Web Application Security” series. In the previous chapters of this basic web developer’s security reckoner we have learned about the various factors and the various security concerns surrounding a web application and how an attacker gains potentially leverage inducing knowledge about the web application infrastructure. We have also learned about the ways in which an attacker gains insight in to the internal workings of a web application for the purpose of targeted attacks. Since we have covered a lot of ground about the basic theories and the mindsets utilized by an attacker in the previous episodes it is time to learn about the practical ways used by him in breaching a web application.