Read more
Informationen zum Autor DAFYDD STUTTARD is an independent security consultant, author, and software developer specializing in penetration testing of web applications and compiled software. Under the alias PortSwigger, Dafydd created the popular Burp Suite of hacking tools. MARCUS PINTO delivers security consultancy and training on web application attack and defense to leading global organizations in the financial, government, telecom, gaming, and retail sectors. The authors cofounded MDSec, a consulting company that provides training in attack and defense-based security. Klappentext New technologies. New attack techniques. Start hacking. Web applications are everywhere, and they're insecure. Banks, retailers, and others have deployed millions of applications that are full of holes, allowing attackers to steal personal data, carry out fraud, and compromise other systems. This book shows you how they do it. This fully updated edition contains the very latest attack techniques and countermeasures, showing you how to break into today's complex and highly functional applications. Roll up your sleeves and dig in. Discover how cloud architectures and social networking have added exploitable attack surfaces to applications Leverage the latest HTML features to deliver powerful cross-site scripting attacks Deliver new injection exploits, including XML external entity and HTTP parameter pollution attacks Learn how to break encrypted session tokens and other sensitive data found in cloud services Discover how technologies like HTML5, REST, CSS and JSON can be exploited to attack applications and compromise users Learn new techniques for automating attacksand dealing with CAPTCHAs and cross-site request forgery tokens Steal sensitive data across domains using seemingly harmless application functions and new browser features Find help and resources at http://mdsec.net/wahh Source code for some of the scripts in the book Links to tools and other resources A checklist of tasks involved in most attacks Answers to the questions posed in each chapter Hundreds of interactive vulnerability labs Zusammenfassung The highly successful security book returns with a new edition, completely updated Web applications are the front door to most organizations, exposing them to attacks that may disclose personal information, execute fraudulent transactions, or compromise ordinary users. Inhaltsverzeichnis Introduction xxiii Chapter 1 Web Application (In)security 1 The Evolution of Web Applications 2 Web Application Security 6 Summary 15 Chapter 2 Core Defense Mechanisms 17 Handling User Access 18 Handling User Input 21 Handling Attackers 30 Managing the Application 35 Summary 36 Questions 36 Chapter 3 Web Application Technologies 39 The HTTP Protocol 39 Web Functionality 51 Encoding Schemes 66 Next Steps 70 Questions 71 Chapter 4 Mapping the Application 73 Enumerating Content and Functionality 74 Analyzing the Application 97 Summary 114 Questions 114 Chapter 5 Bypassing Client-Side Controls 117 Transmitting Data Via the Client 118 Capturing User Data: HTML Forms 127 Capturing User Data: Browser Extensions 133 Handling Client-Side Data Securely 154 Summary 156 Questions 157 Chapter 6 Attacking Authentication 159 Authentication Technologies 160 Design Flaws in Authentication Mechanisms 161 Implementation Flaws in Authentication 185 Securing Authentication 191 Summary 201 Questions 202 Chapter 7 Attacking Session Management 205 The Need for Stat...
