How to Break Web Software: Functional and Security Testing of Web Applications and Web Services [With CDROM]

Very nice book, He covers topics that i never even thought of. Highly recommended

I recently finished reading How to Break Web Software: Functional and Security Testing of Web Applications and Web Services by Mike Andrews and James A. Whittaker. I, like many of you, develop web software for a living. I've always taken security seriously and occasionally sneered when I ran across examples of common mistakes. Having said that, this book was an eye opener for me. The book covers common exploits such as bypassing input validation, SQL injection, and denial of service. There were also several types of attacks I hadn't really considered before. I won't list them here because someone would undoubtedly say, "I can't believe he didn't know about that one!" The authors cover 24 different types of attacks in all. The book also includes coverage of web privacy issues and security related to web services. Finally, as icing on the cake, a CD is included that contains many tools that will find permanent spots in your arsenal. There are tools to do things like scan web servers for common exploits, mirror sites for local analysis, and check SSL cipher strengths. My favorites are the local proxies that will allow you to view and modify posts as they travel from the client and the server. I always knew I could do this, but didn't know how easy it is. The CD also contains the source code of an example site that includes many flaws for you to practice. This book is written for software professionals to help them put the hackers out of business. So, it necessarily includes hacker techniques. If you develop or test web software, you should read this book before the hackers do. :-)

You can't really read a book like this. You read a few pages and prop the book up with a cookbook holder and start typing in the examples. There were a couple I could not duplicate, but almost everything worked as the authors said it would. Great book, or maybe it would be better to say, great tool! The fun starts with chapter 2 and these folks do not spend a lot of time on reconnaisance. They know how to break web software and we start on that by chapter 3. I was a little sad in chapter 5, they did not really do SQL injection justice, but then they hit it again with stored procedures in chapter 7. If there is a weakness to the book it might be chapter 9 and 10, the ending, but I still found both chapters informative. Every large organization I know is building web applications and most of them are doing it badly. If you are a coder, a webmaster, or a manager of any of the above, buy a copy of this book for everyone on your team. I am going to do the same for my team right now.

This is a focussed book with a single aim; to help you find and correct common vulnerabilities in web-based applications and website software. Above all, this is a book to be used. The authors take a practical approach to each area of consideration, and the chapters are well structured to make it easy for you to get right to work. For each area they provide an informative overview followed by discussion of the vulnerabilities including numerous code snippets, examples and screen shots. Though rich in detail the writing style keeps you engaged and the sensible structure (when to apply the attack, how to perform it and how to protect against it) makes it easy to grasp the key points. There is no bias towards either Windows or Unix products on either the client or the server, and you won't need to be a scripting expert to put the authors' ideas into practice. Chapter 1 explains the difference between web-based and traditional client-server systems and why a different approach is needed when testing. Subsequent chapters cover the vulnerabilities: Gathering Information on the Target Bypassing Client-Side Validation State-Based Attacks Including Hidden Fields, Cookie poisoning and Session Hijacking Data Attacks Including Cross-Site Scripting, SQL Injection and Directory Traversal Language-Based Attacks Including Buffer Overflows Server Attacks Including Stored Procedures, SQL Injection, Server Fingerprinting and Denial of Service Authentication Including Weak Cryptography and Cross-Site Tracing Privacy Including Caching, Cookies, Web Bugs, ActiveX Controls and Browser Help Objects Web Services Including WSDL and XML attacks The book comes with an excellent companion CD containing a number of testing tools and a flawed website on which you can use the techniques you have learned to cement your knowledge. Both the tools and the vulnerabilities in the sample site are fully documented in two useful appendices. All in all, a rich and well-focussed yet accessible introduction to a wide-ranging subject. If the security of web-based applications is your area, make room for this on your bookshelf.

If you write external-facing web apps, just accept the fact that someone will try to hack them. The best you can do is to be aware of the different ways that web apps can be broken, and then use those techniques in your testing. Better you find them first before "they" do. I got a review copy of How to Break Web Software: Functional and Security Testing of Web Applications and Web Services by Mike Andrews and James A. Whittaker. Excellent book... Contents: The Web Is Different; Gathering Information on the Web; Attacking the Client; State-Based Attacks; Attacking User-Supplied Input Data; Language-Based Attacks; Attacking the Server; Authentication; Privacy; Web Services; Fifty Years of Software: Key Principles for Quality; Flowershop Bugs; Tools; Index Along with the general information on how web-based applications differ from client-based apps, the authors cover 24 specific attacks with detailed examples on how they work. For instance, I was aware of SQL Injection attacks, but they show an example in there that is a twist I hadn't seen before and that is downright scary. My guess is that there's a lot of data at risk by companies who don't have a clue. There's a CD in the back of the book that contains a number of the tools they use to do their vulnerability testing, and that's almost worth the price of the book alone. For instance, there's Brutus... a brute-force authentication tool. I had also never heard of HTTPrint, which is a tool that targets a server and uses a number of tests to "fingerprint" it and determine the operating system and other items of interest. If you're serious about testing your web applications and securing them against unintended use, then it's best you have these software gems at your disposal. You know the other side already does. Once you understand how your applications can be manipulated, you can become a much better developer by building in security at a foundational layer. For instance, don't trust your JavaScript client side editing routines to validate your data. That input can be changed and sent back to the server. Instead, have input validation both at the client *and* at the server to make sure no data manipulation or validation bypasses were used. Simple stuff like that can save you a ton of headaches and grief down the road. With the cost of privacy lapses running into the millions for companies who fail in that area, you can't afford *not* to take the time to learn how to write and test secure applications. This may well be the best $35 you ever spent on your professional development. Consider it "job insurance" to avoid having to look for another job because your application ended up as a case study in some IT magazine...