Amazon calculates a product’s star ratings based on a machine learned model instead of a raw data average. The model takes into account factors including the age of a rating, whether the ratings are from verified purchasers, and factors that establish reviewer trustworthiness.
You can't really read a book like this. You read a few pages and prop the book up with a cookbook holder and start typing in the examples. There were a couple I could not duplicate, but almost everything worked as the authors said it would. Great book, or maybe it would be better to say, great tool!
The fun starts with chapter 2 and these folks do not spend a lot of time on reconnaisance. They know how to break web software and we start on that by chapter 3. I was a little sad in chapter 5, they did not really do SQL injection justice, but then they hit it again with stored procedures in chapter 7.
If there is a weakness to the book it might be chapter 9 and 10, the ending, but I still found both chapters informative.
Every large organization I know is building web applications and most of them are doing it badly. If you are a coder, a webmaster, or a manager of any of the above, buy a copy of this book for everyone on your team. I am going to do the same for my team right now.
I've been programming for over 10 years and thought that I had encountered it all. Uh ya, I was wrong. I'm amazed that a person can work with something for so long and yet still miss simple things like URL jumping. This is a great 32,000 foot view of web security (not a how to hack book) and covers what you should know if you are a web developer. Even if you alredy "know it all" this is a great read and excellent reference for creating check lists on projects and threats they may be succeptable to.
This is an interesting book to read, specially to QA engineers like me, it covers most of the important topics in web application security. Also, with a CD containing tools used for applying attacks described in the book.
This is a focussed book with a single aim; to help you find and correct common vulnerabilities in web-based applications and website software.
Above all, this is a book to be used. The authors take a practical approach to each area of consideration, and the chapters are well structured to make it easy for you to get right to work.
For each area they provide an informative overview followed by discussion of the vulnerabilities including numerous code snippets, examples and screen shots. Though rich in detail the writing style keeps you engaged and the sensible structure (when to apply the attack, how to perform it and how to protect against it) makes it easy to grasp the key points.
There is no bias towards either Windows or Unix products on either the client or the server, and you won't need to be a scripting expert to put the authors' ideas into practice.
Chapter 1 explains the difference between web-based and traditional client-server systems and why a different approach is needed when testing. Subsequent chapters cover the vulnerabilities:
Gathering Information on the Target
Bypassing Client-Side Validation
Including Hidden Fields, Cookie poisoning and Session Hijacking
Including Cross-Site Scripting, SQL Injection and Directory Traversal
Including Buffer Overflows
Including Stored Procedures, SQL Injection, Server Fingerprinting and Denial of Service
Including Weak Cryptography and Cross-Site Tracing
Including Caching, Cookies, Web Bugs, ActiveX Controls and Browser Help Objects
Including WSDL and XML attacks
The book comes with an excellent companion CD containing a number of testing tools and a flawed website on which you can use the techniques you have learned to cement your knowledge. Both the tools and the vulnerabilities in the sample site are fully documented in two useful appendices.
All in all, a rich and well-focussed yet accessible introduction to a wide-ranging subject. If the security of web-based applications is your area, make room for this on your bookshelf.
The most common problem is that a cracker can get full access to your browser code. So while you might embed various tests on user input, or pass various parameters in the URL or forms, these can be read and usually altered. From which flows such attacks as buffer overflow, SQL injection and cross site scripting [XSS].
All of which means that the real tests must be done on your server, even if this entails replicating tests already done in your browser code.
The merit of this book is in how it provides a good level of introductory detail across the various attack vectors. While the topics discussed by the book can often be described in more detail elsewhere, if you need the extra information. For example, on buffer overflows, see "Buffer Overflow Attacks" by Foster et al. While for defending against SQL injection, there is "Guarding Your Website Against SQL Injection" by Breidenbach. Or, on the subject of using a Web server, Apache is the most common choice. Thus you can confer with "Preventing Web Attacks with Apache" by Barnett, which just came out a few weeks ago. The latter book is a good complement to this one.
The only quibble I have with "How to Break Web Software" is in one sentence - "Phishing is a scam that only diligence and the law will wipe out". It says that no technical solution is possible. I disagree. I am the co-inventor of several antiphishing US Patent Pending methods, that will publish soon at uspto.gov. We believe these to be seminal, and furnish such a technical solution. We actually like this book and its quote, given that it was published in February 2006, and our first Provisionals were filed in September and October 2004. The text is one of several that reflects the state of the art after our submissions, and before they were publicly disclosed.
I reviewed this book in May of 2006 at [...] From that review:
"I find the title disappointing because How to Break Web Software suggests this is another book by media darling attackers who seize every opportunity to show they are clever and everyone else is not. While the subtitle clearly has less shelf appeal, Functional and Security Testing of Web Applications and Web Services more clearly identifies what you'll learn should you read this book.
"The authors begin by explaining the the problem space (web applications and emerging web services) and why this space is problematic (the distributed nature of the web, the extensive and extensible nature of the application development languages and protocols). They then describe web attack methodologies, and explain how each component of a web application (client, server, and the underlying network) can be attacked. The authors present a series of attacks, for each describing the attacker's objective, opportunity (when to apply the attack), how to conduct the attack, and most importantly, how to protect against the attack. The book concludes with discussions of authentication and privacy issues for the web."