Wiley.com
Print this page Share

Professional Pen Testing for Web Applications

ISBN: 978-0-471-78966-6
522 pages
July 2006
Professional Pen Testing for Web Applications  (0471789666) cover image

Description

There is no such thing as "perfect security" when it comes to keeping all systems intact and functioning properly. Good penetration (pen) testing creates a balance that allows a system to be secure while simultaneously being fully functional. With this book, you'll learn how to become an effective penetrator (i.e., a white hat or ethical hacker) in order to circumvent the security features of a Web application so that those features can be accurately evaluated and adequate security precautions can be put in place.

After a review of the basics of web applications, you'll be introduced to web application hacking concepts and techniques such as vulnerability analysis, attack simulation, results analysis, manuals, source code, and circuit diagrams. These web application hacking concepts and techniques will prove useful information for ultimately securing the resources that need your protection.

What you will learn from this book
* Surveillance techniques that an attacker uses when targeting a system for a strike
* Various types of issues that exist within the modern day web application space
* How to audit web services in order to assess areas of risk and exposure
* How to analyze your results and translate them into documentation that is useful for remediation
* Techniques for pen-testing trials to practice before a live project

Who this book is for

This book is for programmers, developers, and information security professionals who want to become familiar with web application security and how to audit it.

Wrox Professional guides are planned and written by working programmers to meet the real-world needs of programmers, developers, and IT professionals. Focused and relevant, they address the issues technology professionals face every day. They provide examples, practical solutions, and expert education in new technologies, all designed to help programmers do a better job.
See More

Table of Contents

Acknowledgments.

Introduction.

Chapter 1: Penetration Testing Web Applications.

Chapter 2: Web Applications: Some Basics.

Chapter 3: Discovery.

Chapter 4: Vulnerability Analysis.

Chapter 5: Attack Simulation Techniques and Tools: Web Server.

Chapter 6: Attack Simulation Techniques and Tools: Web Application.

Chapter 7: Attack Simulation Techniques and Tools: Known Exploits.

Chapter 8: Attack Simulation Techniques and Tools: Web Services.

Chapter 9: Documentation and Presentation.

Chapter 10: Remediation.

Chapter 11: Your Lab.

Appendix A: Basic SQL.

Appendix B: Basic LDAP.

Appendix C: XPath and XQuery.

Appendix D: Injection Attack Dictionaries.

Index.

See More

Author Information

Andres Andreu, CISSP-ISSAP, GSEC currently operates neuroFuzz Application Security LLC (http://www.neurofuzz.com), and has a strong background with the U.S. government. He served the United States of America in Information Technology and Security capacities within a “3-Letter” federal law enforcement agency. The bulk of his time there was spent building the IT Infrastructure and working on numerous intelligence software programs for one of the largest Title III Interception Operations within the continental U.S. He worked there for a decade and during that time he was the recipient of numerous agency awards for outstanding performance.

He holds a bachelor’s degree in Computer Science, graduating Summa Cum Laude with a 3.9 GPA from the American College of Computer and Informational Sciences. Mr. Andreu specializes in software, application, and Web services security, working with XML security, TCP and HTTP(S) level proxying technology, and strong encryption. He has many years of experience with technologies like LDAP, Web services (SOA, SOAP, and so on), enterprise applications, and application integration.

See More

Downloads

Download TitleSizeDownload
Download Code and Scripts Used in the Book

Download a .zip file with the code used in the book.

Note: this file contains all the downloads referenced in the book except the HoneyPot WebApp from Chapter 11.

To uncompress the file, Windows users can use Windows built-in ZIP utilities or a 3rd party utility like WinZip or WinRAR. Macintosh users can simply double-click the downloaded file to extract using the built-in archive utility.

60.49 KB Click to Download
See More

Errata

Do you think you've discovered an error in this book? Please check the list of errata below to see if we've already addressed the error. If not, please submit the error via our Errata Form. We will attempt to verify your error; if you're right, we will post a correction below.

ChapterPageDetailsDatePrint Run
48 Error in Binary
They (Bas) will become ASCII QmFz when Base64 encoded. The binary data looks like this if all blocks are simply concatenated with no spaces in between digits:
01000010011000010111001

should be:

They (Bas) will become ASCII QmFz when Base64 encoded. The binary data looks like this if all blocks are simply concatenated with no spaces in between digits:
010000100110000101110011
05/18/07
52 Section Correction
toward the bottom of page:
should be:
... To ensure clarity take a look at the same XML document just presented as a simple example, only this time with the markup bolded to distinguish it from the text, or content:
<?xml version="1.0"?>

<user-data>
   <name>Your Name</name>
   <mail>Your.Name@YourCompany.com</mail>
   <company>Your Company</company>
   <phone>(888) 123-4567</phone>
</user-data>
06/07/07
66 Error in Text
from xmlrpclib import Server time = Server("http://http://time.xmlrpc.com/RPC2", verbose=1) print(time.currentTime.getCurrentTime())

should be:

from xmlrpclib import Server time = Server("http://time.xmlrpc.com/RPC2", verbose=1) print(time.currentTime.getCurrentTime())
05/18/07
7 337 Typo
in the top paragraph:
cme.exe

should be:
cmd.exe
05/11/07
See More

Related Titles

Back to Top