Web Security Testing Cookbook: Systematic Techniques to Find Problems Fast
Among the tests you perform on web applications, security testing is perhaps the most important, yet it’s often the most neglected. The recipes in the Web Security Testing Cookbook demonstrate how developers and testers can check for the most common web security issues, while conducting unit tests, regression tests, or exploratory tests. Unlike ad hoc security assessments, these recipes are repeatable, concise, and systematic-perfect for integrating into your regular test suite.
Recipes
Rating: 
(out of 5 reviews)
List Price: $ 39.99
Price: $ 18.96
The Web Application Hacker’s Handbook: Discovering and Exploiting Security Flaws
- ISBN13: 9780470170779
- Condition: New
- Notes: BUY WITH CONFIDENCE, Over one million books sold! 98% Positive feedback. Compare our books, prices and service to the competition. 100% Satisfaction Guaranteed
This book is a practical guide to discovering and exploiting security flaws in web applications. The authors explain each category of vulnerability using real-world examples, screen shots and code extracts. The book is extremely practical in focus, and describes in detail the steps involved in detecting and exploiting each kind of security weakness found within a variety of applications such as online banking, e-commerce and other web applications. The topics covered include bypassing log
Rating: (out of 16 reviews)
List Price: $ 50.00
Price: $ 27.87
Review by calvinnme for Web Security Testing Cookbook: Systematic Techniques to Find Problems Fast
Rating:
This book is about how web applications are tested with an emphasis on security. This book is aimed at web applications developers and testers, not security specialists. Developers who are responsible for writing unit tests for their components will appreciate the way that these tools can be focused on an individual page, feature, or form. Quality assurance professionals who must test whole web applications will be especially interested in the automation and development of test cases that can easily become parts of regression suites. The recipes in this book mainly use free tools, making them easy to try out and hopefully adopt.
The unfortunate problem with free tools in so many cases is lack documentation. This book fills that gap by showing you how to make good use of tools that you might have heard of that don’t have good documentation on their application. Another barrier to effectively testing web applications with free tools is a general lack of knowledge about how the tools can be put together to perform good security tests. It’s one thing to know that TamperData lets you bypass client-side checks. It’s another thing to develop a good cross-site scripting test using TamperData. This book takes you beyond making good web application tests and helps you produce good security test cases.
The book divides material into three sections. The first section covers setting up tools and some of the basics concepts used to develop tests. The second section is about the different methods of bypassing client-side input validation via SQL injection, cross-site scripting, and manipulating hidden form fields. The third section is about the session, locating session identifiers, determining their predictability, and how to manipulate them. Each major section begins with relatively simple tasks and gradually builds to more complex tasks. Thus the first recipes are simple exercises that show what happens behind the scenes in web applications. The final recipes put many building blocks together into complex tasks that can form the basis of major web application security tests. The following is a listing and synopsis of each chapter:
Chapter 1, A little terminology and some important testing concepts that are referred to throughout the book.
Chapter 2, Installing Some Free Tools, includes an entire toolbox of free tools you can make use of. Information on each tool includes some basic instructions on where to find it, install it, and get it running.
Chapter 3, Basic Observation, teaches you the basics of observing your web application and testing the functionality of the system.
Chapter 4, Web-Oriented Data Encoding, shows how to encode and decode data in the various ways that web applications use it. In addition to encoding and decoding, you need to be able to eyeball encoded data and have some idea how it has been encoded.
Chapter 5, Tampering with Input, discusses the most important basic technique: malicious input. Discusses how you get it into your application and how you look at what’s happening in the browser and what it’s sending to the web application.
Chapter 6, Automated Bulk Scanning, shows you how to spider your application to find input points and pages, as well as ways to conduct batch tests on some specialized applications.
Chapter 7, Automating Specific Tasks with Curl, shows you a very good tool for building automated tests: Curl. First a a few simple ways of submitting batches of tests are examined. Complexity gradually builds to more difficult tasks such as retaining state when you log in and manipulating cookies, and culminates in the task of logging in on eBay.
Chapter 8, Automating with LibPerl, is focused on Perl and its LWP library. This chapter contains a set of specific techniques that you can use with Perl and the LWP library to perform security tests. These include uploading viruses to your application, using very long filenames, and parsing the responses from your application. It ends with a script that can edit a Wikipedia page.
Chapter 9, Seeking Design Flaws, discusses the unintentional interactions in your web application and how you can reveal them with good security tests. The recipes in this chapter focus on ways you can enable tests with testing programs. Topics includes predictable identifiers, weak randomness, and repeatable transactions.
Chapter 10, Attacking AJAX, shows you a lot of the top web attacks and how you can execute them building on earlier techniques discussed in the book. This book doesn’t have much on AJAX itself, so you may need an additional text on the subject.
Chapter 11, Manipulating Sessions, discusses how to get behind the scenes of AJAX and test it both manually and automatically. The recipes intercept client-side requests to test server-side logic and vice versa, testing the client-side code by manipulating the server’s responses.
Chapter 12, Multifaceted Tests, the final chapter, focuses on sessions, session management, and how security tests can attack it. It gives you several recipes that show you how to find, analyze, and ultimately test the strength of session management.
Review by Ron Gonzalez for Web Security Testing Cookbook: Systematic Techniques to Find Problems Fast
Rating:
This is one of those few books on my bookshelf that I find myself returning to time and time again. My copy is marked, annotated, labeled, etc. so on and so forth. It is indispensable if you work in the industry and IMHO outshines the much larger tome “The Web Application Hackers Handbook”. Of particular importance to Web Engineers is also Appendix E found in the book “Sockets, Shellcode, Porting & Coding”.
Thanks again Paco, excellent book. Please let us know of the second edition as I will definitely pre-order without a doubt.
Review by Richard Bejtlich for Web Security Testing Cookbook: Systematic Techniques to Find Problems Fast
Rating:
I just wrote five star reviews of The Web Application Hacker’s Handbook (TWAHH) and SQL Injection Attacks and Defense (SIAAD). Is there really a need for another Web security book like Web Security Testing Cookbook (WSTC)? The answer is an emphatic yes. While TWAHH and SIAAD include offensive and defensive material helpful for developers, those books are more or less aimed at assessment professionals. WSTC, on the other hand, is directed squarely at Web developers. In fact, WSTC is specifically written for those who incorporate unit testing into their software development lifecycle. I believe anyone developing Web applications would benefit from reading WSTC.
I am not a Web developer, but I really enjoyed reading WSTC. The book is not very long compared to TWAHH and WSTC, but it is very clear and well-written. The test or “recipe” format is easy to read quickly, and it makes for disciplined writing on the part of the authors. I really liked the use of all open tools, in contrast with Hacking Exposed: Web 2.0 (HEW2), a competing book. WSTC is well-organized, building on previous material in a coherent manner suitable for those with less experience in unit testing for Web apps.
I’d like to give special praise to chapter 4, Web-Oriented Data Encoding. As a Network Security Monitoring practitioner, I often encounter Web traffic encoded using the very methods described in chapter 4. This section helped me understand what I see, so I recommend it to those who aren’t Web developers but who do need to understand Web traffic on the wire. I felt the same way about chapter 7, which explains the intricacies of using cURL.
I have no complaints regarding WSTC. I think it defines a powerful methodology for approaching Web security, and other authors might want to consider emulating its approach. Great work!
Review by Midwest Book Review for Web Security Testing Cookbook: Systematic Techniques to Find Problems Fast
Rating:
The WEB SECURITY TESTING COOKBOOK is a winning set of recipe tests to be performed on web applications to assure security standards are met, and cover the basics from observing messages between clients and servers to building original tests pinpointed at Ajax functions. Learn how to obtain, install and use free security testing tools and how to choose from many different methods in a guide packed with scripts and insights.
Diane C. Donovan
California Bookwatch
Review by Olutoyin D. Oladipo for Web Security Testing Cookbook: Systematic Techniques to Find Problems Fast
Rating:
The book was as advertised and its delivery was also on time. You can’t beat that.
Review by Jeff Pike for The Web Application Hacker’s Handbook: Discovering and Exploiting Security Flaws
Rating:
This is the most important IT security title written in the past year or more. Why? Custom web applications offer more opportunities for exploitation than all of the publicized vulnerabilities your hear about combined. This book gives expert treatment to the subject. I found the writing to be very clear and concise in this 727 page volume. There is minimal fluff. While everything is clearly explained, this is not a beginners book. The authors assume that you can read html, JavaScript, etc… Usually with a book like this there are a few really good chapters and some so-so chapters, but that’s not the case here. Chapters 3-18 in this book rock all the way through. Another huge plus is the tools in this book are free.
The first few chapters provide context and background information. Chapter 3 on Web Application Technologies provides particularly useful background info. The next 666 pages of the book are all about attacking the applications.
There next five chapters cover mapping application functionality, client side controls, authentication, sessions, and access controls. The coverage is comprehensive. I’m not new to these topics, but I learned so much in every chapter. The depth of coverage is amazing.
The next six chapters are the heart of this book. They cover injection, path traversal, application logic, XSS and related attacks, automating attacks, and information disclosure. You’ll find full treatment of attacks we’re all familiar with like SQL injection and cross site scripting as well as many that most of us haven’t heard of before. The danger is real and these chapters need to be read.
The final next four chapters cover attacks against compiled applications, application architecture, web servers, and source code. The final two chapters are more useful as a quick reference. They provide an overview of the tools covered throughout the book and describe attack methodology discussed throughout the book for exploiting each technology.
This book scores five easily based on the relevance and value of the information.
Review by R. Wesley McGrew for The Web Application Hacker’s Handbook: Discovering and Exploiting Security Flaws
Rating:
Before you even read a word, “The Web Application Hacker’s Handbook: Discovering and Exploiting Security Flaws” should catch your interest for two reasons. The first is that, by name and cover art, it is being presented by Wiley as the web security counterpart of “The Shellcoder’s Handbook”, which I have already given a positive review. The second reason, which I did not realize it until the book arrived, is that one of the authors, Dafydd Stuttard, is the author of the excellent Burp Suite tools for exploring and exploiting web applications. I use the proxy features of it frequently, and I often tell people it’s the only reason I install a Java VM on my laptop. I was very excited about reading a web application security by the author of such a great set of tools, and it did not let me down.
I will admit that I haven’t read any other books that focus on attacking web applications, so I do not have anything to compare it to. I can say, however, that this book has very complete and thorough coverage of the topic, from mapping the application to exploitation. While a number of common attacks are covered (such as cross-site scripting and SQL injection), the real value of the book is in the way it teaches the process of finding vulnerabilities. Armed with this, you can more effectively discover problems that involve logical errors unique to the application you’re looking at. The book reads very well cover-to-cover, with each chapter building up another step in a complete web application hacker’s methodology that the authors have put together.
The topics covered encompass most of the vulnerabilities you’ll see disclosed in applications daily on the mailing lists. Rather than having chapters for specific attacks, the authors gather them up into meaningful categories to present related content together. For example, SQL injection and remote-file-inclusion are rolled into a chapter titled “Injecting Code”. Similarly, cross-site scripting attacks, session fixation, and request forgery are covered in “Attacking Other Users”. There is introductory material in an early chapter on “Web Application Technologies”, however I would recommend that anyone picking this book up be at least somewhat familiar with how web applications work, either from the viewpoint of a developer or understanding the basics of attacks. The questions at the end of each chapter are designed to test the reader’s understanding of the chapter’s material, and I found it helpful to at least read over them and give them some thought. Someone just getting started with web security would probably get a lot of value out of focusing on each question.
For such a large book, it is a very pleasant surprise to say that I ran across no obvious errors. The website for the book is very complete, and contains answers for all of the questions at the ends of chapters, the source code for a tool developed in one of the chapters, a list of tools described in the text, and a checklist for the methodology presented in the final chapter. If you have an interest in web application security, I would highly recommend picking up a copy of this book, especially if you’re interested in being able to audit applications for vulnerabilities. Even for a web application developer, however, the book has a lot of merit. It’s important to understand the ways in which your application will be attacked, and mitigation strategies are presented in the book for each attack.
I enjoyed the book, found the techniques presented to be very useful, and I plan on making use of the methodology presented.
Review by Seth Fogie for The Web Application Hacker’s Handbook: Discovering and Exploiting Security Flaws
Rating:
First off – I will come clean and admit that this review is biased on several levels. Since the public facing web application security community is small, any published work or presentation will draw the attention of others in the field and often conversations/reviews/blog comments will ensue. Why mention this? Well, Dafydd reviewed XSS Attacks on his blog – a book I co-authored along with other much bigger players in the field. I also have a bit of admiration for Burp, a program Dafydd wrote and is highlighted in most any valuable web app book. So, to say I have no connections to the authors would be misleading – to say the least.
Now, for the book – just buy it, you won’t be disappointed. As I read through the book (scanning some of the familiar parts), I was overwhelmed with the fact that a full time web application penetration tester has to known A LOT – all of which this book touches on in one way or another. I really can’t think of any other book that can compete…
For those new to the field, either as security professionals or as web developers, this book will most likely leave you a bit reeling. It does a good job illustrating and demonstrating the many facets of secure web app development. For the more seasoned professional, this book will no doubt serve as a resource to refresh your memory on a trick or technique you forgot about. I know it has already served this purpose for me…
So, where do I start with a more detailed expose on the book? Personally, I would start by reading chapter 20 – A Web Application Hackers Methodology. By doing this, you will get a look into the minds of the authors who spend a significant part of their lives breaking web apps. You will also gain an understanding as to why the book is laid out the way it is – simply because it is how an attack/penetration test is performed. Don’t expect to understand everything in detail as this will come later. However, you should quickly get the feeling that this book is going to be an interesting read that you can quickly turn into practical coding/attack techniques.
The book is broken down in to several big parts. The first section will acclimate you to the terms, concepts, and environment that the rest of the book builds upon. This includes a brief look at each of the main sections of the server technology, how a web application functions, and an overview of the attack surface you are about to be exposed to.
The second section starts to take a look at the web application from an attacker’s point of view by illustrating numerous ways that an application can be mapped for later analysis. If you are a web developer, chances are you will find that one or more of the techniques discussed will cause a bit of a concern as to how information is stored on your site – you can never assume anything on your web server is safe.
The big section of the book is where you find the fun stuff. Basically, the authors walk through the following stages of a web application attacks – authentication, session management, access control, code injection, web server bugs, logic errors, and compiled application reverse-engineering. In each section, you get a really in depth and comprehensive look at most every attack vector and technique that web application hackers (both good and bad) use to meet their goals.
One of the nice things about this book is that it is not just all theory. They include practical and pointed examples that illustrate the problem, but don’t waste your time with pages and pages of source code that serve no purpose but to fill space. At 736 pages, the book doesn’t need filler.
In addition to the exploit examples, the authors also provide the much needed `protection’ aspect so web developers know how they can shore up their applications against the specific attacks. In my experience, knowing how to secure a web application is often harder than knowing how to break it – so seeing this in the book is a indication of the insight of the authors.
There were three sections that I paid close attention to – partly because I have a vested interest in the subject, and also because it is how I like to present concepts. The first was chapter 11, which covers Attacking Application Logic. In this chapter, the authors used a Function – Assumption – Attack process to outline the problem and how it was exploited. Since logic errors are 100% based on human error, it is very hard to categorize and illustrate without a good example. So, not only did I get to see how others failed, and how this failure resulted in an attack, but it read like a story.
The next section was chapter 12 – Attacking Other Users. This section dove into subjects like XSS, XSRF, and the like – all of which I enjoy as indicated by my work on XSS Attacks book.
And last, but not least, I really liked that the book discussed one aspect of web application security that is often overlooked – reverse-engineering of client side `thick client’. Whether this is a Flash, Java, ActiveX or C++ coded program, it is possible to reverse-engineer the client side code to inject unexpected content into a web based application. So, kudos to the authors for presenting this attack vector.
So, is there anything wrong with the book? Well, except for the fact that it could be bigger – no. This book is an excellent way to understand most every attack out there and it will be a valuable resource for any web developer/security professional. If you want more specific details on a subject, you can find that material elsewhere – Cross Site Scripting Attacks: XSS Exploits and Defense, The Database Hacker’s Handbook: Defending Database Servers, and Exploiting Online Games: Cheating Massively Distributed Systems (Addison-Wesley Software Security Series) are a few examples.
Let’s sum this up. The Web Application Hackers Handbook is a worth while investment, so go buy it.
Review by Kevin M. Horvath for The Web Application Hacker’s Handbook: Discovering and Exploiting Security Flaws
Rating:
If you do any type of professional Web Application Assessments then this is your bible. I have read many books on web app assessments and perform many Web Application Assessments for many large companies and government agencies and this is an excellent resource. I use Dafydd’s Burp Suite and I can not say enough about it. If you are serious about Web Application security then this is a must read. Thanks to Dafydd and Marcus for a great book.
Kevin
Review by Brian Shura for The Web Application Hacker’s Handbook: Discovering and Exploiting Security Flaws
Rating:
This is by far the best book I’ve ever read on web application security. The authors do a great job of describing everything involved in analyzing the security of a web app, both from an attacker’s point of view and in terms of what web developers can do to build their apps in a secure way.
The book is very well organized, and the sections about attacking other users and testing for logical security issues are important areas that not many other books cover in much detail. I especially liked the questions at the end of each chapter – they really make you think and test your understanding of the content that was covered.
I agree with the previous reviewer’s comment about web application scanners being just one piece of a thorough security assessment. The chapter on web application scanners did a great job describing the strengths and weaknesses of these products and didn’t include any marketing fluff.