Available:*
Library | Item Barcode | Call Number | Material Type | Item Category 1 | Status |
---|---|---|---|---|---|
Searching... | 30000010128219 | QA76.9.A25 A525 2006 | Open Access Book | Book | Searching... |
Searching... | 30000010128220 | QA76.9.A25 A525 2006 | Open Access Book | Book | Searching... |
On Order
Summary
Summary
There is no such thing as "perfect security" when it comes to keeping all systems intact and functioning properly. Good penetration (pen) testing creates a balance that allows a system to be secure while simultaneously being fully functional. With this book, you'll learn how to become an effective penetrator (i.e., a white hat or ethical hacker) in order to circumvent the security features of a Web application so that those features can be accurately evaluated and adequate security precautions can be put in place.
After a review of the basics of web applications, you'll be introduced to web application hacking concepts and techniques such as vulnerability analysis, attack simulation, results analysis, manuals, source code, and circuit diagrams. These web application hacking concepts and techniques will prove useful information for ultimately securing the resources that need your protection.
What you will learn from this book
* Surveillance techniques that an attacker uses when targeting a system for a strike
* Various types of issues that exist within the modern day web application space
* How to audit web services in order to assess areas of risk and exposure
* How to analyze your results and translate them into documentation that is useful for remediation
* Techniques for pen-testing trials to practice before a live project
Who this book is for
This book is for programmers, developers, and information security professionals who want to become familiar with web application security and how to audit it.
Wrox Professional guides are planned and written by working programmers to meet the real-world needs of programmers, developers, and IT professionals. Focused and relevant, they address the issues technology professionals face every day. They provide examples, practical solutions, and expert education in new technologies, all designed to help programmers do a better job.
Author Notes
Andres Andreu, CISSP-ISSAP, GSEC currently operates neuroFuzz Application Security LLC ( http://www.neurofuzz.com ), and has a strong background with the U.S. government. He served the United States of America in Information Technology and Security capacities within a "3-Letter" federal law enforcement agency. The bulk of his time there was spent building the IT Infrastructure and working on numerous intelligence software programs for one of the largest Title III Interception Operations within the continental U.S. He worked there for a decade and during that time he was the recipient of numerous agency awards for outstanding performance.
He holds a bachelor's degree in Computer Science, graduating Summa Cum Laude with a 3.9 GPA from the American College of Computer and Informational Sciences. Mr. Andreu specializes in software, application, and Web services security, working with XML security, TCP and HTTP(S) level proxying technology, and strong encryption. He has many years of experience with technologies like LDAP, Web services (SOA, SOAP, and so on), enterprise applications, and application integration.
Table of Contents
Acknowledgments | p. xi |
Introduction | p. xix |
Chapter 1 Penetration Testing Web Applications | p. 1 |
Security Industry Weaknesses | p. 1 |
Application Development Considerations | p. 2 |
Limitations of Edge Security Models | p. 2 |
The Case for Pen Testing | p. 3 |
Industry Preparedness | p. 3 |
The Bottom Line | p. 5 |
The Mindset | p. 6 |
Creativity | p. 6 |
Digging Deep | p. 7 |
The Goal | p. 8 |
Methodology | p. 8 |
Rolling Documentation | p. 9 |
This Book | p. 9 |
The Business | p. 10 |
Requirements | p. 11 |
Rules of Engagement | p. 11 |
Self Protection | p. 12 |
Summary | p. 13 |
Chapter 2 Web Applications: Some Basics | p. 15 |
Architectural Aspects | p. 15 |
What Is a Web Application? | p. 16 |
The Tiers | p. 19 |
The HTTP Protocol | p. 21 |
HTTP Proxy | p. 25 |
SSL/TLS | p. 28 |
Application Aspects | p. 35 |
State | p. 35 |
Dynamic Technologies | p. 37 |
Web-Based Authentication | p. 41 |
Data Aspects | p. 42 |
Encryption vs. Encoding | p. 42 |
XML | p. 51 |
Emerging Web Application Models | p. 56 |
Integration | p. 56 |
Frameworks | p. 67 |
Wireless | p. 68 |
Summary | p. 70 |
Chapter 3 Discovery | p. 71 |
Logistics | p. 72 |
WHOIS | p. 72 |
DNS | p. 75 |
ARIN | p. 76 |
SamSpade | p. 77 |
Filter Detection | p. 80 |
OS Fingerprinting | p. 85 |
Netcraft | p. 85 |
pOf | p. 86 |
Web Server Fingerprinting | p. 89 |
HTTP Headers | p. 89 |
httprint | p. 92 |
Application Fingerprinting | p. 93 |
Port Mapping | p. 94 |
Service Identification | p. 97 |
Database Identification | p. 103 |
Analyze Error Pages | p. 104 |
File Type Probes | p. 106 |
Resource Enumeration | p. 107 |
HTML Source Sifting | p. 116 |
Information Harvesting | p. 118 |
Web Services | p. 124 |
UDDI and DISCO | p. 125 |
WSIL | p. 127 |
J2EE | p. 128 |
Summary | p. 131 |
Chapter 4 Vulnerability Analysis | p. 133 |
OWASP and the Top Ten Threats | p. 134 |
WASC | p. 134 |
A1 Unvalidated Input | p. 136 |
Validation | p. 136 |
Manipulation | p. 136 |
A2 Broken Access Control | p. 141 |
A3 Broken Authentication and Session Management | p. 142 |
Authentication | p. 142 |
Session | p. 146 |
A4 Cross-Site Scripting (XSS) Flaws | p. 154 |
Cross-Site Tracing (XST) | p. 157 |
A5 Buffer Overflows | p. 158 |
A6 Injection Flaws | p. 163 |
LDAP Injection | p. 163 |
OS Commanding | p. 165 |
SQL Injection | p. 166 |
SSI Injection | p. 173 |
XPath Injection | p. 173 |
XXE | p. 174 |
A7 Improper Error Handling | p. 175 |
A8 Insecure Storage | p. 176 |
Live Data | p. 177 |
Archived Data | p. 177 |
A9 Denial of Service (DoS) | p. 178 |
Target: Web Server | p. 179 |
Target: User | p. 180 |
Target: DB | p. 180 |
A10 Insecure Configuration Management | p. 181 |
Other Areas | p. 183 |
Insufficient Authentication | p. 183 |
Weak Password Recovery Validation | p. 183 |
Content Spoofing | p. 183 |
Information Leakage | p. 184 |
Abuse of Functionality | p. 184 |
Insufficient Anti-Automation | p. 185 |
Insufficient Process Validation | p. 185 |
Reverse Engineering | p. 185 |
Threat Modeling | p. 186 |
1 Decompose and Understand the Application | p. 187 |
2 Analysis of Threats | p. 188 |
3 Categorization and Ranking of Threats | p. 189 |
4 Identification of Mitigation Strategies | p. 190 |
5 Pen Test | p. 193 |
Methodologies and Tools | p. 193 |
Summary | p. 194 |
Chapter 5 Attack Simulation Techniques and Tools: Web Server | p. 195 |
Identifying Threats | p. 196 |
Default Content and Settings | p. 196 |
Attacks on the System | p. 197 |
Configuration | p. 201 |
Product-Specific Issues | p. 204 |
Tools | p. 214 |
Nessus | p. 214 |
Commercial Tools | p. 215 |
Summary | p. 217 |
Chapter 6 Attack Simulation Techniques and Tools: Web Application | p. 219 |
The App Checklist | p. 220 |
Manual Testing | p. 222 |
The Proxy | p. 222 |
Custom Scripts | p. 234 |
Frameworks | p. 244 |
SQL Injection | p. 246 |
Authentication | p. 248 |
Buffer Overflow | p. 266 |
Client-Side Attacks | p. 268 |
XSS | p. 268 |
Active Content | p. 270 |
Cookies | p. 271 |
Client-Side Example | p. 272 |
Automated Testing | p. 273 |
The Proxy | p. 274 |
Scanners | p. 285 |
Multi-Purpose Scanners | p. 294 |
Commercial Tools | p. 306 |
Web Application Related | p. 306 |
DB Related | p. 313 |
Summary | p. 313 |
Chapter 7 Attack Simulation Techniques and Tools: Known Exploits | p. 315 |
Manual Examples | p. 317 |
Example 1 Domino WebMail | p. 317 |
Example 2 IIS | p. 326 |
Using MetaSploit | p. 338 |
Moving Forward ... | p. 347 |
SecurityFocus | p. 347 |
HSC | p. 349 |
CERT | p. 351 |
Secunia | p. 351 |
eEye | p. 351 |
OSVDB | p. 351 |
CVE | p. 352 |
Warning | p. 352 |
Commercial Products | p. 355 |
Immunity CANVAS | p. 355 |
Core Impact | p. 356 |
Summary | p. 356 |
Chapter 8 Attack Simulation Techniques and Tools: Web Services | p. 357 |
The Reality | p. 358 |
Identifying Threats | p. 359 |
XML Content Attacks | p. 359 |
Web Service Attacks | p. 362 |
Infrastructure Attacks | p. 362 |
Simulating the Attack | p. 364 |
Footprinting | p. 364 |
Enumeration | p. 368 |
Analysis | p. 371 |
Testing/Attacking | p. 373 |
Documentation | p. 392 |
Commercial Tools | p. 394 |
WebInspect | p. 395 |
Moving Forward ... | p. 396 |
WSID4ID | p. 396 |
AJAX | p. 397 |
Summary | p. 399 |
Chapter 9 Documentation and Presentation | p. 401 |
Results Verification | p. 402 |
False Positives | p. 402 |
Document Structure | p. 406 |
Executive Summary | p. 406 |
Risk Matrix | p. 408 |
Best Practices | p. 413 |
Final Summary | p. 416 |
Results Document Security | p. 416 |
Compliance Factors | p. 417 |
Presentation Techniques | p. 423 |
Summary | p. 423 |
Chapter 10 Remediation | p. 425 |
Edge-Level Protection | p. 426 |
Web Application Firewalls | p. 426 |
Web Services | p. 430 |
Some Best Practices | p. 432 |
Input Validation | p. 432 |
Session Management | p. 442 |
Code Audit | p. 445 |
Summary | p. 446 |
Chapter 11 Your Lab | p. 449 |
Hardware | p. 450 |
Servers | p. 450 |
Network | p. 450 |
Storage | p. 450 |
Software | p. 451 |
Client Tools | p. 451 |
Server OS Installations | p. 452 |
Web Applications | p. 457 |
webAppHoneypot | p. 468 |
Summary | p. 469 |
Appendix A Basic SQL | p. 471 |
Appendix B Basic LDAP | p. 477 |
Appendix C XPath and XQuery | p. 483 |
Appendix D Injection Attack Dictionaries | p. 495 |
Index | p. 505 |