Professional pen testing for Web applications

Library	Item Barcode	Call Number	Material Type	Item Category 1	Status
Searching... PSZ JB	30000010128219	QA76.9.A25 A525 2006	Open Access Book	Book	Searching... Unknown
Searching... PSZ KL	30000010128220	QA76.9.A25 A525 2006	Open Access Book	Book	Searching... Unknown

There is no such thing as "perfect security" when it comes to keeping all systems intact and functioning properly. Good penetration (pen) testing creates a balance that allows a system to be secure while simultaneously being fully functional. With this book, you'll learn how to become an effective penetrator (i.e., a white hat or ethical hacker) in order to circumvent the security features of a Web application so that those features can be accurately evaluated and adequate security precautions can be put in place.

After a review of the basics of web applications, you'll be introduced to web application hacking concepts and techniques such as vulnerability analysis, attack simulation, results analysis, manuals, source code, and circuit diagrams. These web application hacking concepts and techniques will prove useful information for ultimately securing the resources that need your protection.

What you will learn from this book
* Surveillance techniques that an attacker uses when targeting a system for a strike
* Various types of issues that exist within the modern day web application space
* How to audit web services in order to assess areas of risk and exposure
* How to analyze your results and translate them into documentation that is useful for remediation
* Techniques for pen-testing trials to practice before a live project

Who this book is for

This book is for programmers, developers, and information security professionals who want to become familiar with web application security and how to audit it.

Wrox Professional guides are planned and written by working programmers to meet the real-world needs of programmers, developers, and IT professionals. Focused and relevant, they address the issues technology professionals face every day. They provide examples, practical solutions, and expert education in new technologies, all designed to help programmers do a better job.

Author Notes

Andres Andreu, CISSP-ISSAP, GSEC currently operates neuroFuzz Application Security LLC ( http://www.neurofuzz.com ), and has a strong background with the U.S. government. He served the United States of America in Information Technology and Security capacities within a "3-Letter" federal law enforcement agency. The bulk of his time there was spent building the IT Infrastructure and working on numerous intelligence software programs for one of the largest Title III Interception Operations within the continental U.S. He worked there for a decade and during that time he was the recipient of numerous agency awards for outstanding performance.

He holds a bachelor's degree in Computer Science, graduating Summa Cum Laude with a 3.9 GPA from the American College of Computer and Informational Sciences. Mr. Andreu specializes in software, application, and Web services security, working with XML security, TCP and HTTP(S) level proxying technology, and strong encryption. He has many years of experience with technologies like LDAP, Web services (SOA, SOAP, and so on), enterprise applications, and application integration.

Acknowledgments	p. xi
Introduction	p. xix
Chapter 1 Penetration Testing Web Applications	p. 1
Security Industry Weaknesses	p. 1
Application Development Considerations	p. 2
Limitations of Edge Security Models	p. 2
The Case for Pen Testing	p. 3
Industry Preparedness	p. 3
The Bottom Line	p. 5
The Mindset	p. 6
Creativity	p. 6
Digging Deep	p. 7
The Goal	p. 8
Methodology	p. 8
Rolling Documentation	p. 9
This Book	p. 9
The Business	p. 10
Requirements	p. 11
Rules of Engagement	p. 11
Self Protection	p. 12
Summary	p. 13
Chapter 2 Web Applications: Some Basics	p. 15
Architectural Aspects	p. 15
What Is a Web Application?	p. 16
The Tiers	p. 19
The HTTP Protocol	p. 21
HTTP Proxy	p. 25
SSL/TLS	p. 28
Application Aspects	p. 35
State	p. 35
Dynamic Technologies	p. 37
Web-Based Authentication	p. 41
Data Aspects	p. 42
Encryption vs. Encoding	p. 42
XML	p. 51
Emerging Web Application Models	p. 56
Integration	p. 56
Frameworks	p. 67
Wireless	p. 68
Summary	p. 70
Chapter 3 Discovery	p. 71
Logistics	p. 72
WHOIS	p. 72
DNS	p. 75
ARIN	p. 76
SamSpade	p. 77
Filter Detection	p. 80
OS Fingerprinting	p. 85
Netcraft	p. 85
pOf	p. 86
Web Server Fingerprinting	p. 89
HTTP Headers	p. 89
httprint	p. 92
Application Fingerprinting	p. 93
Port Mapping	p. 94
Service Identification	p. 97
Database Identification	p. 103
Analyze Error Pages	p. 104
File Type Probes	p. 106
Resource Enumeration	p. 107
HTML Source Sifting	p. 116
Information Harvesting	p. 118
Web Services	p. 124
UDDI and DISCO	p. 125
WSIL	p. 127
J2EE	p. 128
Summary	p. 131
Chapter 4 Vulnerability Analysis	p. 133
OWASP and the Top Ten Threats	p. 134
WASC	p. 134
A1 Unvalidated Input	p. 136
Validation	p. 136
Manipulation	p. 136
A2 Broken Access Control	p. 141
A3 Broken Authentication and Session Management	p. 142
Authentication	p. 142
Session	p. 146
A4 Cross-Site Scripting (XSS) Flaws	p. 154
Cross-Site Tracing (XST)	p. 157
A5 Buffer Overflows	p. 158
A6 Injection Flaws	p. 163
LDAP Injection	p. 163
OS Commanding	p. 165
SQL Injection	p. 166
SSI Injection	p. 173
XPath Injection	p. 173
XXE	p. 174
A7 Improper Error Handling	p. 175
A8 Insecure Storage	p. 176
Live Data	p. 177
Archived Data	p. 177
A9 Denial of Service (DoS)	p. 178
Target: Web Server	p. 179
Target: User	p. 180
Target: DB	p. 180
A10 Insecure Configuration Management	p. 181
Other Areas	p. 183
Insufficient Authentication	p. 183
Weak Password Recovery Validation	p. 183
Content Spoofing	p. 183
Information Leakage	p. 184
Abuse of Functionality	p. 184
Insufficient Anti-Automation	p. 185
Insufficient Process Validation	p. 185
Reverse Engineering	p. 185
Threat Modeling	p. 186
1 Decompose and Understand the Application	p. 187
2 Analysis of Threats	p. 188
3 Categorization and Ranking of Threats	p. 189
4 Identification of Mitigation Strategies	p. 190
5 Pen Test	p. 193
Methodologies and Tools	p. 193
Summary	p. 194
Chapter 5 Attack Simulation Techniques and Tools: Web Server	p. 195
Identifying Threats	p. 196
Default Content and Settings	p. 196
Attacks on the System	p. 197
Configuration	p. 201
Product-Specific Issues	p. 204
Tools	p. 214
Nessus	p. 214
Commercial Tools	p. 215
Summary	p. 217
Chapter 6 Attack Simulation Techniques and Tools: Web Application	p. 219
The App Checklist	p. 220
Manual Testing	p. 222
The Proxy	p. 222
Custom Scripts	p. 234
Frameworks	p. 244
SQL Injection	p. 246
Authentication	p. 248
Buffer Overflow	p. 266
Client-Side Attacks	p. 268
XSS	p. 268
Active Content	p. 270
Cookies	p. 271
Client-Side Example	p. 272
Automated Testing	p. 273
The Proxy	p. 274
Scanners	p. 285
Multi-Purpose Scanners	p. 294
Commercial Tools	p. 306
Web Application Related	p. 306
DB Related	p. 313
Summary	p. 313
Chapter 7 Attack Simulation Techniques and Tools: Known Exploits	p. 315
Manual Examples	p. 317
Example 1 Domino WebMail	p. 317
Example 2 IIS	p. 326
Using MetaSploit	p. 338
Moving Forward ...	p. 347
SecurityFocus	p. 347
HSC	p. 349
CERT	p. 351
Secunia	p. 351
eEye	p. 351
OSVDB	p. 351
CVE	p. 352
Warning	p. 352
Commercial Products	p. 355
Immunity CANVAS	p. 355
Core Impact	p. 356
Summary	p. 356
Chapter 8 Attack Simulation Techniques and Tools: Web Services	p. 357
The Reality	p. 358
Identifying Threats	p. 359
XML Content Attacks	p. 359
Web Service Attacks	p. 362
Infrastructure Attacks	p. 362
Simulating the Attack	p. 364
Footprinting	p. 364
Enumeration	p. 368
Analysis	p. 371
Testing/Attacking	p. 373
Documentation	p. 392
Commercial Tools	p. 394
WebInspect	p. 395
Moving Forward ...	p. 396
WSID4ID	p. 396
AJAX	p. 397
Summary	p. 399
Chapter 9 Documentation and Presentation	p. 401
Results Verification	p. 402
False Positives	p. 402
Document Structure	p. 406
Executive Summary	p. 406
Risk Matrix	p. 408
Best Practices	p. 413
Final Summary	p. 416
Results Document Security	p. 416
Compliance Factors	p. 417
Presentation Techniques	p. 423
Summary	p. 423
Chapter 10 Remediation	p. 425
Edge-Level Protection	p. 426
Web Application Firewalls	p. 426
Web Services	p. 430
Some Best Practices	p. 432
Input Validation	p. 432
Session Management	p. 442
Code Audit	p. 445
Summary	p. 446
Chapter 11 Your Lab	p. 449
Hardware	p. 450
Servers	p. 450
Network	p. 450
Storage	p. 450
Software	p. 451
Client Tools	p. 451
Server OS Installations	p. 452
Web Applications	p. 457
webAppHoneypot	p. 468
Summary	p. 469
Appendix A Basic SQL	p. 471
Appendix B Basic LDAP	p. 477
Appendix C XPath and XQuery	p. 483
Appendix D Injection Attack Dictionaries	p. 495
Index	p. 505

Available:*

On Order

Summary

Summary

Author Notes

Table of Contents