I'm in the process of trying to learn more about ethical hacking, however a lot of the sources I am reading about have a lot of text/theory with very little hands on work. I was wondering if anyone could point me in the direction of place where I could learn more about the practical side of things like XSS / SQL injection / etc.

Are there any definitive sources of learning about this sort of thing?


7 Answers 7


OWASP has several great resources to learn about xss, sql injection, etc.

I suggest you check out their WebGoat project and the Testing Project. These are both great resources to get you started and are free.

WebGoat is a deliberately insecure J2EE web application maintained by OWASP designed to teach web application security lessons. In each lesson, users must demonstrate their understanding of a security issue by exploiting a real vulnerability in the WebGoat application.

There are currently over 30 lessons, including those dealing with the following issues: Cross-site Scripting (XSS), Access Control, Thread Safety, Hidden Form Field Manipulation, Parameter Manipulation, Weak Session Cookies, Blind SQL Injection , Numeric SQL Injection, String SQL Injection, Web Services, Fail Open Authentication, Dangers of HTML Comments, ... and many more! https://www.owasp.org/index.php/OWASP_WebGoat_Project

The OWASP Testing Guide includes a "best practice" penetration testing framework which users can implement in their own organizations and a "low level" penetration testing guide that describes techniques for testing most common web application and web service security issues. https://www.owasp.org/index.php/Category:OWASP_Testing_Project


Have some cheese!

Google has a great resource just for this purpose. Gruyere is a website they have created to help developers (and testers) with security flaws. The app is full of security holes and google has written challenges setup for you to break the site. It's really wonderful. Each challenge is labeled with a style (black box, white box, somewhere inbetween), the code is available to run locally, it offers hints and resolutions. So hopefully its just what your looking for!


  • This site is ace. I use it in conjunction with the textbooks, but it also takes you through the basics.
    – DuncN
    Sep 25, 2011 at 20:04

If you want to learn hacking/cracking/black hat stuff, Google is your friend, but if you want specific information about the topic there are security training programs:


There appear to be many programs, each selling its own manual.

If that's too much and your interest is less formal, you could check out the series entitle "Stealing the Network: How to Own the _". There are many of them on Amazon. They are a little lighter reading and entertaining, but they may be a bit out of date.


The SANS org has some good security courses. http://www.sans.org/security-training/courses.php



as well as the OWASP & Google sites mentioned above


I can get you started on the SQL injection side. Most SQL injection involves the semi-colon (;). The injection attack cleverly ends the current SQL statement, using the semi-colon, and starts one with your injection statement. Some systems safe guard against this method by filtering your input, but there is probably a way to fool the filter.

On an ethical standpoint, I can't think of a way to ethically do SQL injection since it involves performing an operation on a large data-set, which can be damaging.

I know there are some hits, through Google, that give examples to SQL injection; due to researching the methods while designing a security system.

  • Ethical hacking (in this context) was simply a way of describing a company that has hired you for your skills in Penetration testing, i.e. they want you to see if their sites are vulnerable to such activity Aug 10, 2011 at 11:08

If you have time on Septemer 21 there is a Weeknight testing dedicated to security testing


  • gutted i missed this.
    – DuncN
    Sep 25, 2011 at 20:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.