Web Application Security, 2nd Edition

Index

Symbols

• 404 pages, Default Error Messages and 404 Pages-Default Error Messages and 404 Pages

A

• account takeover (ATO), Account Takeover Workflow-SSH Remote Login
• actions, Attacking Data and Objects, Modeling Actions
• admin/sys admin (system administrators), Language and Terminology
• advanced vulnerability scoring, Advanced Vulnerability Scoring
• AJAX payloads, AJAX Payloads
• allowlisting, Bypassing Common Defenses, Allowlisting Commands, Validation and Allowlisting
• AngularJS, Angular
• Ant, Java
• anti-CSRF middleware, Anti-CSRF middleware
• anti-CSRF tokens, CSRF Tokens
• anti-patterns
  • blocklists, Blocklists
  • boilerplate code, Boilerplate Code
  • client/server coupling, Client/Server Separation
  • trust-by-default, Trust-by-Default
• Apache, Web Servers
• API endpoint analysis
  • authentication mechanisms, Authentication Mechanisms-Authentication Mechanisms
  • endpoint shapes, Endpoint Shapes-Application-Specific Shapes
  • enumeration vulnerabilities, Enumeration
  • methods for, GraphQL
  • overview of, Summary
  • purpose of, Endpoint Discovery-Endpoint Discovery
• APIs (Application Programming Interfaces)
  • definition of term, Language and Terminology
  • recommended to avoid, Sanitizing User Input
• application architecture
  • defensive, Defensive Software Architecture
  • framing and sandboxing, Framing and Sandboxing-Shadow Realms
  • identifying weak points in, Identifying Weak Points in Application Architecture
  • key points, Recon
  • secure, Secure Application Architecture-Summary
  • secure versus insecure architecture signals, Secure Versus Insecure Architecture Signals ...