Foreword |
|
xvii | |
Acknowledgments |
|
xix | |
Introduction |
|
xxi | |
1 Hacking Web Apps 101 |
|
1 | (30) |
|
What Is Web Application Hacking? |
|
|
2 | (7) |
|
|
2 | (1) |
|
|
3 | (1) |
|
Methods, Headers, and Body |
|
|
4 | (2) |
|
|
6 | (1) |
|
Authentication, Sessions, and Authorization |
|
|
6 | (1) |
|
|
7 | (1) |
|
|
8 | (1) |
|
Why Attack Web Applications? |
|
|
9 | (2) |
|
|
11 | (1) |
|
|
11 | (1) |
|
How Are Web Apps Attacked? |
|
|
12 | (14) |
|
|
13 | (1) |
|
|
14 | (4) |
|
|
18 | (7) |
|
|
25 | (1) |
|
|
26 | (1) |
|
|
26 | (1) |
|
References & Further Reading |
|
|
27 | (4) |
2 Profiling |
|
31 | (56) |
|
|
32 | (13) |
|
Footprinting and Scanning: Defining Scope |
|
|
32 | (1) |
|
|
33 | (1) |
|
Advanced HTTP Fingerprinting |
|
|
34 | (4) |
|
Infrastructure Intermediaries |
|
|
38 | (7) |
|
|
45 | (37) |
|
|
46 | (20) |
|
Search Tools for Profiling |
|
|
66 | (6) |
|
|
72 | (5) |
|
Common Web Application Profiles |
|
|
77 | (5) |
|
|
82 | (3) |
|
|
83 | (1) |
|
|
83 | (1) |
|
|
84 | (1) |
|
|
84 | (1) |
|
|
85 | (1) |
|
References & Further Reading |
|
|
85 | (2) |
3 Hacking Web Platforms |
|
87 | (36) |
|
Point-and-Click Exploitation Using Metasploit |
|
|
89 | (3) |
|
|
92 | (12) |
|
|
104 | (3) |
|
Web Platform Security Best Practices |
|
|
107 | (12) |
|
|
107 | (3) |
|
|
110 | (3) |
|
|
113 | (5) |
|
|
118 | (1) |
|
|
119 | (1) |
|
References & Further Reading |
|
|
119 | (4) |
4 Attacking Web Authentication |
|
123 | (44) |
|
Web Authentication Threats |
|
|
124 | (27) |
|
Username/Password Threats |
|
|
124 | (20) |
|
Strong(er) Web Authentication |
|
|
144 | (3) |
|
Web Authentication Services |
|
|
147 | (4) |
|
|
151 | (10) |
|
|
151 | (2) |
|
Cross-site Request Forgery |
|
|
153 | (4) |
|
|
157 | (4) |
|
|
161 | (1) |
|
Some Final Thoughts: Identity Theft |
|
|
161 | (1) |
|
|
162 | (2) |
|
References & Further Reading |
|
|
164 | (3) |
5 Attacking Web Authorization |
|
167 | (54) |
|
|
169 | (8) |
|
|
169 | (1) |
|
Identifying Access Tokens |
|
|
170 | (2) |
|
|
172 | (2) |
|
|
174 | (1) |
|
|
175 | (2) |
|
|
177 | (1) |
|
|
178 | (18) |
|
|
179 | (8) |
|
|
187 | (7) |
|
|
194 | (1) |
|
|
195 | (1) |
|
Authorization Attack Case Studies |
|
|
196 | (14) |
|
Horizontal Privilege Escalation |
|
|
196 | (5) |
|
Vertical Privilege Escalation |
|
|
201 | (3) |
|
|
204 | (2) |
|
|
206 | (1) |
|
Using cURL to Map Permissions |
|
|
207 | (3) |
|
Authorization Best Practices |
|
|
210 | (7) |
|
|
211 | (3) |
|
Web Authorization/Session Token Security |
|
|
214 | (2) |
|
|
216 | (1) |
|
|
217 | (1) |
|
References & Further Reading |
|
|
218 | (3) |
6 Input Injection Attacks |
|
221 | (46) |
|
|
222 | (2) |
|
Where to Find Attack Vectors |
|
|
224 | (1) |
|
Bypass Client-Side Validation Routines |
|
|
225 | (1) |
|
Common Input Injection Attacks |
|
|
225 | (36) |
|
|
226 | (1) |
|
Canonicalization (dot-dot-slash) |
|
|
227 | (6) |
|
|
233 | (3) |
|
|
236 | (1) |
|
Manipulate Application Behavior |
|
|
237 | (1) |
|
|
238 | (13) |
|
|
251 | (3) |
|
|
254 | (1) |
|
Custom Parameter Injection |
|
|
255 | (1) |
|
|
256 | (1) |
|
|
257 | (2) |
|
|
259 | (1) |
|
|
259 | (1) |
|
|
260 | (1) |
|
|
261 | (1) |
|
|
262 | (2) |
|
References & Further Reading |
|
|
264 | (3) |
7 Attacking XML Web Services |
|
267 | (28) |
|
|
268 | (11) |
|
Transport: SOAP over HTTP(S) |
|
|
269 | (4) |
|
|
273 | (2) |
|
Directory Services: UDDI and DISCO |
|
|
275 | (4) |
|
Similarities to Web Application Security |
|
|
279 | (1) |
|
|
279 | (9) |
|
Web Service Security Basics |
|
|
288 | (3) |
|
|
291 | (1) |
|
References & Further Reading |
|
|
292 | (3) |
8 Attacking Web Application Management |
|
295 | (40) |
|
|
296 | (3) |
|
|
296 | (1) |
|
|
297 | (1) |
|
Proprietary Management Ports |
|
|
298 | (1) |
|
Other Administration Services |
|
|
299 | (1) |
|
|
299 | (10) |
|
|
299 | (1) |
|
|
300 | (1) |
|
|
300 | (2) |
|
|
302 | (7) |
|
|
309 | (23) |
|
Unnecessary Web Server Extensions |
|
|
309 | (3) |
|
Information Leakage Misconfigurations |
|
|
312 | (15) |
|
State Management Misconfiguration |
|
|
327 | (5) |
|
|
332 | (1) |
|
References & Further Reading |
|
|
333 | (2) |
9 Hacking Web Clients |
|
335 | (36) |
|
|
336 | (16) |
|
Web Client Implementation Vulnerabilities |
|
|
337 | (15) |
|
|
352 | (6) |
|
|
358 | (6) |
|
|
359 | (2) |
|
Firefox Security Extensions |
|
|
361 | (1) |
|
|
361 | (2) |
|
Server-side Countermeasures |
|
|
363 | (1) |
|
|
364 | (1) |
|
References & Further Reading |
|
|
364 | (7) |
10 The Enterprise Web Application Security Program |
|
371 | (42) |
|
|
372 | (10) |
|
Clarify Security Objectives |
|
|
374 | (1) |
|
|
374 | (1) |
|
|
375 | (2) |
|
Decompose the Application |
|
|
377 | (1) |
|
Identify and Document Threats |
|
|
377 | (2) |
|
|
379 | (1) |
|
Develop Threat Mitigation Strategies |
|
|
380 | (2) |
|
|
382 | (15) |
|
Manual Source Code Review |
|
|
382 | (5) |
|
Automated Source Code Review |
|
|
387 | (1) |
|
|
387 | (10) |
|
Security Testing of Web App Code |
|
|
397 | (4) |
|
|
397 | (2) |
|
Test Tools, Utilities, and Harnesses |
|
|
399 | (1) |
|
|
400 | (1) |
|
Security in the Web Development Process |
|
|
401 | (8) |
|
|
401 | (3) |
|
|
404 | (2) |
|
|
406 | (3) |
|
|
409 | (1) |
|
References & Further Reading |
|
|
410 | (3) |
A Web Application Security Checklist |
|
413 | (6) |
B Web Hacking Tools and Techniques Cribsheet |
|
419 | (10) |
Index |
|
429 | |