A web-designing language is HTML, so is CSS. Learning these are fairly simple, as HTML is the framework, the building blocks (and windows), while CSS, is the paint / design. Most HTML tags has a start and an end, e.g., <b>Hello World</b>. (Bold text.)
There isn't much to know / learn about HTML, except if you want to follow coding standards which has pretty much nothing to do with web app pentesting, besides you can look at code and think it looks horrible. So all you need to know is how to create a simple HTML page, and how the tags, attributes, values, and such work. (A good thing to know, is what you can use in specific tags, such as eventhandlers. You don't need to memorize this, you can just use w3schools.com for starters and lookup tags there most of the time.)
A simple HTML page is this:
<html>
<head>
<title>Hello World</title>
</head>
<body>
<h1>Hello World!</h1>
</body>
</html>
As you can see, it's fairly basic. Knowing why it's built like that, and what the difference is between putting a <script> tag in the <head></head> or <body></body> section, is useful for conducting e.g., XSS attacks which in essence, are fairly simple too. (I won't describe that now.) As I already mentioned, eventhandlers such as <body onload="alert('Hello World')" > is useful to know, as the "onload" eventhandler will execute the javascript that is within it, and it will execute when the page is loads aka "on loading".
JavaScript, are the mechanics behind. It's anything from popup boxes, to icons / buttons you click in e.g., the editor you use to reply on Ethical Hacker that inserts a smiley or makes the text bold, etc., to facebook and twitter dynamically loading new tweets or wallposts. The last feature is generally called ajax, which you don't need to know a lot about, except what it is and generally how it works. (If you're pentesting an ajax application it's often fairly simple, as you would focus on XML vulnerabilities quite often, which you'll get to, in time.)
XML, yet another language. What is it? Generally, it's just information stored in a simple language format, that can be parsed by a lot of programs, and websites. Of course, each program or website has its own way of creating these files (the content within which can be read with a text editor), but in essence XML is cross-compatible with anything that can read XML. (It may not work as intended from a website to a program, but it should be possible to do in most cases.)
So XML can be information shared dynamically in an open format.
A database, is what makes up most websites. The type is quite often MySQL or MSSQL where the latter is made by Microsoft. Both has their own features / potential vulnerabilities caused by e.g., misconfigurations, but the database is of course used to hold the data for the website as you're probably aware of. The SQL language is also, in most cases a "Cross-compatible language", or a universal language meaning it looks the same when used with various SQL databases. While it is possible to use JavaScript and websockets to connect to a database, often it is the backend language used.
The backend language, is often PHP, ASP (or for that sake JSP, RoR or .NET). This language is not necessary for a website to function, but it can be used to control sessions properly, and add extra functionality which e.g., JavaScript isn't as effective with, as the backend language uses the server-resources, while all the others (except the database of course), uses client-resources.
I should of course note, that with HTML5 it is possible to store files on the client system. This is called "HTML5 Storage" and if you open this on your computer, you will see that quite a few websites without you knowing it, already uses this feature to store e.g., their large JavaScript files to ensure faster loading and less waiting time
It may seem like a lot, but most of it is really not. The biggest areas that may seem advanced or like a lot, are:
- Advanced SQL queries (Using CAST(), Encoding Schemes, CASE, etc.)
- PHP (Source code review where e.g., preg_replace() is used, or even htmlentities() is used properly but not implemented correct)
- HTML5 and CSS3, both has a lot of new features that even I haven't fully looked into.
- Advanced XSS Injections using JavaScript DOM.
You should try to get the basics first before learning about those in depth.
1) There's a lot to know about web app sec, but for starters and up to intermediate level, look at the Owasp Top 10
https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project and the Testing Project:
https://www.owasp.org/index.php/OWASP_Testing_Project2) Learn how to make basic applications in the languages you want to know, and of course more importantly know how to read the syntax. If you can read the syntax and generally know how a language is built, then you only need to find out what specific functions do. Using the "xxxxx for pentesters" books can be good, but keep in mind some of them may be quite advanced and discuss topics like buffer overflows which may seem hard to grasp at some points. You can check out "Gray Hat Python", but take a look at the contents first.
About your list, I think you should remove Python or Perl and add PHP instead. It's good to know how both are "built", but generally people use either Perl or Python. A long time ago, it was as if all hackers only used Perl, but now it seems like more has gone over to using Python, and well, I prefer Python too
So learn Perl or Python, and PHP, instead of learning both scripting languages which you don't really need to, except the syntax and how they function.
