CodeHistory.org
FIELD NOTE / 2026.09.214 MIN READ / 8 SOURCES

The Minds Behind Web Application Security – 7 People Redefining Software

Seven researchers helped define Web application security through SQL injection, XSS, protocol analysis, software assurance, exploit frameworks, and browser research.

Written byTheo MercerEDITOR · CODEHISTORY RESEARCH DESKRESEARCHED / CITED

TL;DR

Web application security became a distinct field when researchers realized that firewalls could not protect applications from malicious input delivered through perfectly valid HTTP. Forristal publicized SQL injection and built early scanning tools; Grossman, Hansen, Klein, Wysopal, Moore, and Zalewski expanded the field through XSS research, protocol attacks, automated assessment, exploit frameworks, secure-development practice, and browser analysis.[1][4][5]

Why you should read it anyway

The Web moved business logic and sensitive data behind interfaces reachable by anyone with a browser. That made application code itself part of the security perimeter. Input validation, session management, authentication, authorization, browser origin rules, and software dependencies all became attack surfaces.

Imagine where Web Application Security would be without them

Without this research community, organizations would rely longer on network security while overlooking vulnerabilities inside HTTP applications. SQL injection, XSS, request-smuggling-style inconsistencies, and authentication flaws would remain easier to exploit at scale.

Time Estimate of how many years we would be hindered without them for human progress

Editorial counterfactual estimate: 4–8 years. Web breaches would eventually force application-security practice to mature, but public research, OWASP-style education, scanners, and exploit frameworks accelerated recognition of the problem.[8]

The 7 people behind Web Application Security

1. Jeff Forristal

Why they matter: Forristal, known as Rain Forest Puppy, is credited by Black Hat with the first publicized recognition of SQL injection in a 1998 Phrack article and with creating Whisker, an early intelligent open-source Web application scanner.[1] His contribution helped establish Web applications themselves as a distinct attack surface rather than merely another server process.

2. Jeremiah Grossman

Why they matter: Grossman became one of the field’s most influential application-security practitioners after serving as a Yahoo security officer and founding WhiteHat Security.[2] His work on large-scale Web assessment, XSS, and application attack-surface measurement helped turn manual penetration testing into continuous organizational practice.

3. Robert Hansen

Why they matter: Hansen, known as RSnake, researched Web exploitation, browser behavior, XSS, and application attack classes and later worked closely with Grossman.[3] His contribution was attacker-minded exploration of edge cases in browsers, HTTP, and application logic that conventional network defenses often missed.

4. Amit Klein

Why they matter: Klein became known for deep research into HTTP, Web servers, request parsing, session behavior, and browser/server inconsistencies. His work exposed classes of Web attacks created not by one broken program but by disagreement between layers of the stack. He represents protocol-level application-security research rather than one named commercial product.[7]

5. Chris Wysopal

Why they matter: Wysopal helped publicize insecure software through L0pht, co-developed responsible-disclosure practices, and co-founded Veracode around automated application-security analysis.[4] His contribution connected hacker vulnerability research with a software-development model in which organizations scan code and binaries before deployment.

6. H. D. Moore

Why they matter: Moore founded the Metasploit Project in 2003 as a public exploit-development and penetration-testing framework.[5] Metasploit changed application and network security testing by turning individual exploit research into reusable modules that defenders could use to validate whether vulnerabilities were actually exploitable.

7. Michal Zalewski

Why they matter: Zalewski conducted broad research into browser behavior, Web application attack surfaces, fuzzing, and content-sniffing problems. Google’s security blog documents his work showing how browsers can reinterpret seemingly harmless hosted content in dangerous ways.[6] His contribution is systematic exploration of the messy boundary between specifications and real browser behavior.

How they each differ from one another

Forristal identified foundational Web attack classes and scanning; Grossman and Hansen expanded large-scale Web assessment and research; Klein focused on HTTP/browser/server inconsistencies; Wysopal connected vulnerability research to software assurance; Moore industrialized exploit validation; Zalewski explored browser and Web behavior systematically. The field spans discovery, exploitation, testing, and prevention.

Final Take

Web application security changed the question from “is the server reachable?” to “what can an attacker make the application do?” That shift remains essential because the most damaging vulnerabilities often travel through legitimate protocol paths and exploit flaws in the application’s own logic.

RESEARCH / PROVENANCE

Works Cited

8 SOURCES
  1. 01
  2. 02
  3. 03
  4. 04
  5. 05
  6. 06
  7. 07
  8. 08

CodeHistory is a living archive. Citations document the evidence used for this edition; later evidence may refine the account.

Contribute / Corrections

Improve the record.

Use this moderated submission form to suggest a correction, provide a source, challenge a priority claim or identify a missing contributor. Submissions are treated as research leads, not automatically published comments.

Submit a research lead

Please do not submit confidential material or claims you cannot support.