Hacking web apps : detecting and preventing web application security problems / Mike Shema

Von:

Shema, Mike [aut]

Resource type: Ressourcentyp: Buch (Online)Buch (Online)Sprache: Englisch Verlag: Amsterdam ; Boston : Syngress, c2012Auflage: Online-AusgBeschreibung: Online-Ressource (1 online resource (xx, 273 p.)) : illISBN:

9781283578820
1283578824
9781597499569

Schlagwörter:

Andere physische Formen: 9781597499569 | 9781597499514 | 1283578662 | Erscheint auch als: 1283578662 Druck-Ausgabe | Erscheint auch als: 9781597499514 Druck-AusgabeDDC-Klassifikation:

005.8

LOC-Klassifikation:

TK5105.59

Online-Ressourcen:

Zugang im Netz des KIT

Zusammenfassung: How can an information security professional keep up with all of the hacks, attacks, and exploits on the Web? One way is to read Hacking Web Apps. The content for this book has been selected by author Mike Shema to make sure that we are covering the most vicious attacks out there. Not only does Mike let you in on the anatomy of these attacks, but he also tells you how to get rid of these worms, trojans, and botnets and how to defend against them in the future. Countermeasures are detailed so that you can fight against similar attacks as they evolve. Attacks featured in this book include: SQL Injection Cross Site Scripting Logic Attacks Server Misconfigurations Predictable Pages Web of Distrust Breaking Authentication Schemes HTML5 Security Breaches Attacks on Mobile Apps Even if you don't develop web sites or write HTML, Hacking Web Apps can still help you learn how sites are attacked-as well as the best way to defend against these attacks. Plus, Hacking Web Apps gives you detailed steps to make the web browser - sometimes your last line of defense - more secure. More and more data, from finances to photos, is moving into web applications. How much can you trust that data to be accessible from a web browser anywhere and safe at the same time? Some of the most damaging hacks to a web site can be executed with nothing more than a web browser and a little knowledge of HTML. Learn about the most common threats and how to stop them, including HTML Injection, XSS, Cross Site Request Forgery, SQL Injection, Breaking Authentication Schemes, Logic Attacks, Web of Distrust, Browser Hacks and many more.Zusammenfassung: Intro -- Half Title -- Title Page -- Copyright -- About the Author -- Acknowledgements -- Contents -- Introduction -- 1 HTML5 -- The New Document Object Model (DOM) -- Cross-Origin Resource Sharing (CORS) -- WebSockets -- Transferring Data -- Data Frames -- Security Considerations -- Web Storage -- IndexedDB -- Web Workers -- Flotsam &amp -- Jetsam -- History API -- Draft APIs -- Summary -- 2 HTML Injection &amp -- Cross-Site Scripting (XSS) -- Understanding HTML Injection -- Identifying Points of Injection -- URI Components -- Form Fields -- HTTP Request Headers &amp -- Cookies -- JavaScript Object Notation (JSON) -- Document Object Model (DOM) Properties -- Cascading Style Sheets (CSS) -- User-Generated Content -- Identifying the Type of Reflection -- Ephemeral -- Persistent -- Out of Band -- Identifying the Injection's Rendered Context -- Element Attributes -- Elements &amp -- Text Nodes -- JavaScript Variables -- Syntax Delimiters -- Putting the Hack Together -- Abusing Character Sets -- Attack Camouflage with Percent Encoding -- Encoding 0X00-Nothing Really Matters -- Alternate Encodings for the Same Character -- Why Encoding Matters for HTML Injection -- Exploiting Failure Modes -- Bypassing Weak Exclusion Lists -- Leveraging Browser Quirks -- The Unusual Suspects -- Subverting MIME Types -- Surprising MIME Types -- SVG Markup -- The Impact of XSS -- Data Redirection -- Employing Countermeasures -- Fixing a Static Character Set -- Normalizing Character Sets and Encoding -- Encoding the Output -- Beware of Exclusion Lists and Regexes -- Reuse, Don't Reimplement, Code -- JavaScript Sandboxes -- HTML5 &lt -- iframe&gt -- Sandboxes -- Browsers' Built-In XSS Defenses -- Summary -- 3 Cross-Site Request Forgery (CSRF) -- Understanding Cross-Site Request Forgery -- The Mechanics of CSRF -- Request Forgery via Forced Browsing -- POST Forgery.PPN: PPN: 809872455Package identifier: Produktsigel: ZDB-26-MYL | ZDB-30-PAD | ZDB-30-PQE

Exemplare ( 0 )

Dieser Titel hat keine Exemplare