 |
Want to be kept informed?
Please register and set your
preferences to request a newsletter
|
|
| |
REVIEW: "How to Break Web Software", Mike Andrews/James A. Whittaker | posted by Markus on Wednesday August 09, @04:59AM ( Printer Friendly Version.| Email this article) | | | |  Robert Slade reviews How to Break Web Software by Mike Andrews & James A. Whittaker:
The preface stresses that this book is neither about how to attack a
Web site, nor how to develop one, but, rather, how to test.
And here am I, thinking that it's usually the users that break things ;-)
|
| | |
| | | Chapter one points out that the Web is a different environment, in
terms of software security, because we have desktop machines, not
centrally administered, talking to everyone (with much of the traffic
being commercial in nature). The authors even point out that issues
of error-handling, performance, and ease-of-use all contribute to
increased levels of vulnerability. Various attacks designed to obtain
information about Web applications, structure, and functions are
described in chapter two. For client-side scripting, chapter three
notes, any validation done on the client should be untrusted and re-
validated on the host, since it may be altered on the client, or data
manually entered as if it came from the client. Chapter four explains
the danger of using client-side data (cookies or code) for state
information. Chapter five examines user supplied data, and delves
into cross-site scripting (XSS, the explanation of which is not well
done), SQL (Standard Query Language) injection, and directory
traversal. Language-based attacks, in chapter six, involve buffer
overflows (which are not explained terribly well), canonicalization
(HTML and Unicode encoding and parsing), and null string attacks. The
server, with utilities and the underlying operating system, can be
reached via stored procedures (excessive functionality), fingerprinted
for other attempts, or subject to denial of service (in limited ways)
as chapter seven notes. "Authentication," in chapter eight, is really
more about encryption: the various false forms (encryption via
obscurity?), brute force attacks against verification systems, and
forcing a system to use weak encryption. Privacy, and related Web
technologies (of which cookies are only one), is reviewed in chapter
nine. Chapter ten looks at Web services, and the vulnerabilities
associated with some of these systems.
The CD-ROM included with the book contains a number of interesting and
useful tools for trying out the various attacks and tests mentioned in
the text.
This book is a valuable addition to the software security literature.
The attacks listed in the work are known, but often by name only.
This text collects and explains a wide variety of Web application
attacks and weaknesses, providing developers with a better
understanding of how their programs may be assailed. Some of the
items mentioned are defined or explained weakly, but these are usually
items that do have good coverage in other security works.
copyright Robert M. Slade, 2006 BKHTBWSW.RVW 20060520
======================
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Dictionary Information Security www.syngress.com/catalog/?pid=4150
http://victoria.tc.ca/techrev/rms.htm
Title: How to Break Web Software
Author: Mike Andrews
Author: James A. Whittaker
Publication Date: 2006
ISBN: 0-321-36944-0
Price: USD34.99
Author email: Mike.Andrews@foundstone.com
Author email: jw@cs.fit.edu
Publisher: Addison-Wesley Publishing Co.
Pages: 219 + CD-ROM
Topic: Computing
Topic: Security
Topic: Web Development |
| | |
You can hit the "Reply" button below to add your comments (Site Under Development)
< Hunter S. Thompson – The Rum Diary - Review
| |
|
