Mike Shema - Hacking Web Apps: Detecting and Preventing Web Application Security Problems

Mike Shema

487 Hill Street, San Francisco, CA 94114, USA

Tel.: +1 415 871 3880

Book Overview and Key Learning Points

Book Audience

How this Book is Organized

Where to Go From Here

Pick your favorite cliche or metaphor youve heard regarding The Web. The aphorism might generically describe Web security or evoke a mental image of the threats faced by and emanating from Web sites. This book attempts to illuminate the vagaries of Web security by tackling eight groups of security weaknesses and vulnerabilities most commonly exploited by hackers. Some of the attacks will sound very familiar. Other attacks may be unexpected, or seem unfamiliar simply because they neither adorn a top 10 list nor make headlines. Attackers might go for the lowest common denominator, which is why vulnerabilities like cross-site scripting and SQL injection garner so much attentionthey have an unfortunate combination of pervasiveness and ease of exploitation. Determined attackers might target ambiguities in the design of a sites workflows or assumptionsexploits that result in significant financial gain that may be specific to one site only, but leave few of the tell-tale signs of compromise that more brutish attacks like SQL injection do.

On the Web information equals money. Credit cards clearly have value to hackers; underground carder sites have popped up that deal in stolen cards; complete with forums, user feedback, and seller ratings. Yet our personal information, passwords, email accounts, on-line game accounts, and so forth all have value to the right buyer, let alone the value we personally place in keeping such things private. Consider the murky realms of economic espionage and state-sponsored network attacks that have popular attention and grand claims, but a scarcity of reliable public information. (Not that it matters to Web security that cyberwar exists or not; on that topic we care more about WarGames and Wintermute for this book.) Its possible to map just about any scam, cheat, trick, ruse, and other synonyms from real-world conflict between people, companies, and countries to an analogous attack executed on the Web. Theres no lack of motivation for trying to gain illicit access to the wealth of information on the Web, whether for glory, country, money, or sheer curiosity.