Produktbild: The Web Application Hacker's Handbook

The Web Application Hacker's Handbook Finding and Exploiting Security Flaws

52,99 €

inkl. gesetzl. MwSt., Versandkostenfrei


Beschreibung

Produktdetails

Verkaufsrang

46557

Einband

Taschenbuch

Erscheinungsdatum

07.10.2011

Verlag

John Wiley & Sons Inc

Seitenzahl

878

Maße (L/B/H)

23,6/18,8/5,1 cm

Gewicht

1624 g

Auflage

2. Auflage

Sprache

Englisch

ISBN

978-1-118-02647-2

Beschreibung

Produktdetails

Verkaufsrang

46557

Einband

Taschenbuch

Erscheinungsdatum

07.10.2011

Verlag

John Wiley & Sons Inc

Seitenzahl

878

Maße (L/B/H)

23,6/18,8/5,1 cm

Gewicht

1624 g

Auflage

2. Auflage

Sprache

Englisch

ISBN

978-1-118-02647-2

Herstelleradresse

Libri GmbH
Europaallee 1
36244 Bad Hersfeld
DE

Email: gpsr@libri.de

Kundinnen und Kunden meinen

0 Bewertungen

Informationen zu Bewertungen

Zur Abgabe einer Bewertung ist eine Anmeldung im Konto notwendig. Die Authentizität der Bewertungen wird von uns nicht überprüft. Wir behalten uns vor, Bewertungstexte, die unseren Richtlinien widersprechen, entsprechend zu kürzen oder zu löschen.

Die Bewertungen sind nach Format, Anzahl Sterne und Datum sortiert.

Verfassen Sie die erste Bewertung zu diesem Artikel

Helfen Sie anderen Kund*innen durch Ihre Meinung

Kundinnen und Kunden meinen

0 Bewertungen filtern

Die Leseprobe wird geladen.
  • Produktbild: The Web Application Hacker's Handbook
  • Introduction xxiii

    Chapter 1 Web Application (In)security 1

    The Evolution of Web Applications 2

    Web Application Security 6

    Summary 15

    Chapter 2 Core Defense Mechanisms 17

    Handling User Access 18

    Handling User Input 21

    Handling Attackers 30

    Managing the Application 35

    Summary 36

    Questions 36

    Chapter 3 Web Application Technologies 39

    The HTTP Protocol 39

    Web Functionality 51

    Encoding Schemes 66

    Next Steps 70

    Questions 71

    Chapter 4 Mapping the Application 73

    Enumerating Content and Functionality 74

    Analyzing the Application 97

    Summary 114

    Questions 114

    Chapter 5 Bypassing Client-Side Controls 117

    Transmitting Data Via the Client 118

    Capturing User Data: HTML Forms 127

    Capturing User Data: Browser Extensions 133

    Handling Client-Side Data Securely 154

    Summary 156

    Questions 157

    Chapter 6 Attacking Authentication 159

    Authentication Technologies 160

    Design Flaws in Authentication Mechanisms 161

    Implementation Flaws in Authentication 185

    Securing Authentication 191

    Summary 201

    Questions 202

    Chapter 7 Attacking Session Management 205

    The Need for State 206

    Weaknesses in Token Generation 210

    Weaknesses in Session Token Handling 233

    Securing Session Management 248

    Summary 254

    Questions 255

    Chapter 8 Attacking Access Controls 257

    Common Vulnerabilities 258

    Attacking Access Controls 266

    Securing Access Controls 278

    Summary 284

    Questions 284

    Chapter 9 Attacking Data Stores 287

    Injecting into Interpreted Contexts 288

    Injecting into SQL 291

    Injecting into NoSQL 342

    Injecting into XPath 344

    Injecting into LDAP 349

    Summary 354

    Questions 354

    Chapter 10 Attacking Back-End Components 357

    Injecting OS Commands 358

    Manipulating File Paths 368

    Injecting into XML Interpreters 383

    Injecting into Back-end HTTP Requests 390

    Injecting into Mail Services 397

    Summary 402

    Questions 403

    Chapter 11 Attacking Application Logic 405

    The Nature of Logic Flaws 406

    Real-World Logic Flaws 406

    Avoiding Logic Flaws 428

    Summary 429

    Questions 430

    Chapter 12 Attacking Users: Cross-Site Scripting 431

    Varieties of XSS 433

    XSS Attacks in Action 442

    Finding and Exploiting XSS Vulnerabilities 451

    Preventing XSS Attacks 492

    Summary 498

    Questions 498

    Chapter 13 Attacking Users: Other Techniques 501

    Inducing User Actions 501

    Capturing Data Cross-Domain 515

    The Same-Origin Policy Revisited 524

    Other Client-Side Injection Attacks 531

    Local Privacy Attacks 550

    Attacking ActiveX Controls 555

    Attacking the Browser 559

    Summary 568

    Questions 568

    Chapter 14 Automating Customized Attacks 571

    Uses for Customized Automation 572

    Enumerating Valid Identifiers 573

    Harvesting Useful Data 583

    Fuzzing for Common Vulnerabilities 586

    Putting It All Together: Burp Intruder 590

    Barriers to Automation 602

    Summary 613

    Questions 613

    Chapter 15 Exploiting Information Disclosure 615

    Exploiting Error Messages 615

    Gathering Published Information 625

    Using Inference 626

    Preventing Information Leakage 627

    Summary 629

    Questions 630

    Chapter 16 Attacking Native Compiled Applications 633

    Buffer Overflow Vulnerabilities 634         

    Integer Vulnerabilities 640

    Format String Vulnerabilities 643

    Summary 645

    Questions 645

    Chapter 17 Attacking Application Architecture 647

    Tiered Architectures 647

    Shared Hosting and Application Service Providers 656

    Summary 667

    Questions 667

    Chapter 18 Attacking the Application Server 669

    Vulnerable Server Configuration 670

    Vulnerable Server Software 684

    Web Application Firewalls 697

    Summary 699

    Questions 699

    Chapter 19 Finding Vulnerabilities in Source Code 701

    Approaches to Code Review 702

    Signatures of Common Vulnerabilities 704

    The Java Platform 711

    ASP.NET 718

    PHP 724

    Perl 735

    JavaScript 740

    Database Code Components 741

    Tools for Code Browsing 743

    Summary 744

    Questions 744

    Chapter 20 A Web Application Hacker's Toolkit 747

    Web Browsers 748

    Integrated Testing Suites 751

    Standalone Vulnerability Scanners 773

    Other Tools 785

    Summary 789

    Chapter 21 A Web Application Hacker's Methodology 791

    General Guidelines 793

    1 Map the Application's Content 795

    2 Analyze the Application 798

    3 Test Client-Side Controls 800

    4 Test the Authentication Mechanism 805

    5 Test the Session Management Mechanism 814

    6 Test Access Controls 821

    7 Test for Input-Based Vulnerabilities 824

    8 Test for Function-Specific Input Vulnerabilities 836

    9 Test for Logic Flaws 842

    10 Test for Shared Hosting Vulnerabilities 845

    11 Test for Application Server Vulnerabilities 846

    12 Miscellaneous Checks 849

    13 Follow Up Any Information Leakage 852

    Index 853