Download PDF The Web Application Hacker’s Handbook Second Edition Finding and Exploiting Security by Flaws Dafydd Stuttard

Sinopsis

There is no doubt that web application security is a current and newsworthy subject. For all concerned, the stakes are high: for businesses that derive increasing revenue from Internet commerce, for users who trust web applications with sensitive information, and for criminals who can make big money by stealing payment details or compromising bank accounts. Reputation plays a critical role. Few people want to do business with an insecure website, so few organizations want to disclose details about their own security vulnerabilities or breaches. Hence, it is not a trivial task to obtain reliable information about the state of web application security today.

This chapter takes a brief look at how web applications have evolved and the many benefi ts they provide. We present some metrics about vulnerabilities in current web applications, drawn from the authors’ direct experience, demonstrating that the majority of applications are far from secure. We describe the core security problem facing web applications — that users can supply arbitrary input — and the various factors that contribute to their weak security posture. Finally, we describe the latest trends in web application security and how these may be expected to develop in the near future.

Content

1. Web Application (In)security
2. Core Defense Mechanisms
3. Web Application Technologies
4. Mapping the Application
5. Bypassing Client-Side Controls
6. Attacking Authentication
7. Attacking Session Management
8. Attacking Access Controls
9. Attacking Data Stores
10. Attacking Back-End Components
11. Attacking Application Logic
12. Attacking Users: Cross-Site Scripting
13. Attacking Users: Other Techniques
14. Automating Customized Attacks
15. Exploiting Information Disclosure
16. Attacking Native Compiled Applications
17. Attacking Application Architecture
18. Attacking the Application Server
19. Finding Vulnerabilities in Source Code
20. A Web Application Hacker’s Toolkit
21. A Web Application Hacker’s Methodology

Click here to download