Book description
Over 75% of network attacks are targeted at the web application layer. This book provides explicit hacks, tutorials, penetration tests, and step-by-step demonstrations for security professionals and Web application developers to defend their most vulnerable applications.This book defines Web application security, why it should be addressed earlier in the lifecycle in development and quality assurance, and how it differs from other types of Internet security. Additionally, the book examines the procedures and technologies that are essential to developing, penetration testing and releasing a secure Web application. Through a review of recent Web application breaches, the book will expose the prolific methods hackers use to execute Web attacks using common vulnerabilities such as SQL Injection, Cross-Site Scripting and Buffer Overflows in the application layer. By taking an in-depth look at the techniques hackers use to exploit Web applications, readers will be better equipped to protect confidential.
- The Yankee Group estimates the market for Web application-security products and services will grow to $1.74 billion by 2007 from $140 million in 2002
- Author Michael Cross is a highly sought after speaker who regularly delivers Web Application presentations at leading conferences including: Black Hat, TechnoSecurity, CanSec West, Shmoo Con, Information Security, RSA Conferences, and more
Table of contents
- Front Cover
- Developer's Guide to Web Application Security
- Copyright Page (1/2)
- Copyright Page (2/2)
- Contents (1/2)
- Contents (2/2)
-
Chapter 1. Hacking Methodology
- Introduction
- A Brief History of Hacking
- What Motivates a Hacker?
- Understanding Current Attack Types (1/3)
- Understanding Current Attack Types (2/3)
- Understanding Current Attack Types (3/3)
- Recognizing Web Application Security Threats
- Preventing Break-Ins by Thinking like a Hacker
- Summary
- Solutions Fast Track
- Frequently Asked Questions
-
Chapter 2. How to Avoid Becoming a Code Grinder
- Introduction
- What Is a Code Grinder?
- Thinking Creatively when Coding
- Security from the Perspective of a Code Grinder
- Building Functional and Secure Web Applications (1/3)
- Building Functional and Secure Web Applications (2/3)
- Building Functional and Secure Web Applications (3/3)
- Summary
- Solutions Fast Track
- Frequently Asked Questions
-
Chapter 3. Understanding the Risk Associated with Mobile Code
- Introduction
- Recognizing the Impact of Mobile Code Attacks
- Identifying Common Forms of Mobile Code (1/7)
- Identifying Common Forms of Mobile Code (2/7)
- Identifying Common Forms of Mobile Code (3/7)
- Identifying Common Forms of Mobile Code (4/7)
- Identifying Common Forms of Mobile Code (5/7)
- Identifying Common Forms of Mobile Code (6/7)
- Identifying Common Forms of Mobile Code (7/7)
- Protecting Your System from Mobile Code Attacks (1/2)
- Protecting Your System from Mobile Code Attacks (2/2)
- Summary
- Solutions Fast Track
- Frequently Asked Questions
-
Chapter 4. Vulnerable CGI Scripts
- Introduction
- What Is a CGI Script, and What Does It Do?
- Break-Ins Resulting from Weak CGI Scripts (1/4)
- Break-Ins Resulting from Weak CGI Scripts (2/4)
- Break-Ins Resulting from Weak CGI Scripts (3/4)
- Break-Ins Resulting from Weak CGI Scripts (4/4)
- Languages for Writing CGI Scripts
- Advantages of Using CGI Scripts
- Rules for Writing Secure CGI Scripts
- Summary
- Solutions Fast Track
- Frequently Asked Questions
-
Chapter 5. Hacking Techniques and Tools
- Introduction
- A Hacker’s Goals (1/2)
- A Hacker’s Goals (2/2)
- The Five Phases of Hacking (1/2)
- The Five Phases of Hacking (2/2)
- Defacing Web Sites
- Social Engineering
- The Intentional “Back Door”Attack
- Exploiting Inherent Weaknesses in Code or Programming Environments
- The Tools of the Trade
- Summary
- Solutions Fast Track
- Frequently Asked Questions
-
Chapter 6. Code Auditing and Reverse Engineering
- Introduction
- How to Efficiently Trace through a Program
- Auditing and Reviewing Selected Programming Languages
- Looking for Vulnerabilities (1/4)
- Looking for Vulnerabilities (2/4)
- Looking for Vulnerabilities (3/4)
- Looking for Vulnerabilities (4/4)
- Pulling It All Together
- Summary
- Solutions Fast Track
- Frequently Asked Questions
-
Chapter 7. Securing Your Java Code
- Introduction
- Overview of the Java Security Architecture (1/2)
- Overview of the Java Security Architecture (2/2)
- How Java Handles Security (1/4)
- How Java Handles Security (2/4)
- How Java Handles Security (3/4)
- How Java Handles Security (4/4)
- Potential Weaknesses in Java
- Coding Functional but Secure Java Applets (1/6)
- Coding Functional but Secure Java Applets (2/6)
- Coding Functional but Secure Java Applets (3/6)
- Coding Functional but Secure Java Applets (4/6)
- Coding Functional but Secure Java Applets (5/6)
- Coding Functional but Secure Java Applets (6/6)
- Summary
- Solutions Fast Track
- Frequently Asked Questions
- Chapter 8. Securing XML
- Chapter 9. Building Safe ActiveX Internet Controls
-
Chapter 10. Securing ColdFusion
- Introduction
- How Does ColdFusion Work?
- Preserving ColdFusion Security (1/4)
- Preserving ColdFusion Security (2/4)
- Preserving ColdFusion Security (3/4)
- Preserving ColdFusion Security (4/4)
- ColdFusion Application Processing (1/2)
- ColdFusion Application Processing (2/2)
- Risks Associated with Using ColdFusion (1/2)
- Risks Associated with Using ColdFusion (2/2)
- Summary
- Solutions Fast Track
- Frequently Asked Questions
-
Chapter 11. Developing Security-Enabled Applications
- Introduction
- The Benefits of Using Security-Enabled Applications
- Types of Security Used in Applications (1/3)
- Types of Security Used in Applications (2/3)
- Types of Security Used in Applications (3/3)
- Reviewing the Basics of PKI (1/2)
- Reviewing the Basics of PKI (2/2)
- Using PKI to Secure Web Applications
- Implementing PKI in Your Web Infrastructure
- Testing Your Security Implementation
- Summary
- Solutions Fast Track
- Frequently Asked Questions
- Chapter 12. Cradle to Grave: Working with a Security Plan
- Index (1/7)
- Index (2/7)
- Index (3/7)
- Index (4/7)
- Index (5/7)
- Index (6/7)
- Index (7/7)
Product information
- Title: Developer's Guide to Web Application Security
- Author(s):
- Release date: April 2011
- Publisher(s): Syngress
- ISBN: 9780080504094
You might also like
book
Securing Web Applications
Most enterprise applications today live on the network edge, right where attackers are focusing increasing attention …
book
Security for Web Developers
As a web developer, you may not want to spend time making your web app secure, …
book
Web Application Vulnerabilities
In this book, we aim to describe how to make a computer bend to your will …
book
How to Break Web Software: Functional and Security Testing of Web Applications and Web Services
Rigorously test and improve the security of all your Web software! It’s as certain as death …