Web Application Security, A Beginner's Guide by Sullivan, Bryan -- Read -- Imperial Library of Trantor

Index

ACKNOWLEDGMENTS INTRODUCTION PART I Primer 1 Welcome to the Wide World of Web Application Security

Misplaced Priorities and the Need for a New Focus Network Security versus Application Security: The Parable of the Wizard and the Magic Fruit Trees

Real-World Parallels

Thinking like a Defender The OWASP Top Ten List

#1. Injection #2. Cross-Site Scripting (XSS) #3. Broken Authentication and Session Management #4. Insecure Direct Object References #5. Cross-Site Request Forgery #6. Security Misconfiguration #7. Insecure Cryptographic Storage #8. Failure to Restrict URL Access #9. Insufficient Transport Layer Protection #10. Unvalidated Redirects and Forwards Wrapping Up the OWASP Top Ten

Secure Features, Not Just Security Features Final Thoughts

2 Security Fundamentals

Input Validation

Blacklist Validation Whitelist Validation More Validation Practices The Defense-in-Depth Approach

Attack Surface Reduction

Attack Surface Reduction Rules of Thumb

Classifying and Prioritizing Threats

STRIDE IIMF CIA Common Weakness Enumeration (CWE) DREAD Common Vulnerability Scoring System (CVSS)

PART II Web Application Security Principles 3 Authentication

Access Control Overview Authentication Fundamentals

Proving Your Identity

Two-Factor and Three-Factor Authentication Web Application Authentication

Password-Based Authentication Systems Built-In HTTP Authentication Single Sign-On Authentication Custom Authentication Systems Validating Credentials

Securing Password-Based Authentication

Attacks Against Passwords The Importance of Password Complexity Password Best Practices

Secure Authentication Best Practices

When and Where to Perform Authentication Securing Web Authentication Mechanisms

4 Authorization

Access Control Continued

Authorization Session Management Authorization Fundamentals Authorization Goals Detailed Authorization Check Process Types of Permissions Authorization Layers Controls by Layer Custom Authorization Mechanisms Client-Side Attack TOCTTOU Exploit Web Authorization Best Practices Attacks Against Authorization

Session Management Fundamentals

What’s a Session? How to Manage Session State? Why Do We Need Session Management? Attacks Against Sessions SSL and HTTPS Jetty: Session Predictability in the Real World Attacks Against Session State

Securing Web Application Session Management

Session Management Best Practices

5 Browser Security Principles: The Same-Origin Policy

Defining the Same-Origin Policy

An Important Distinction: Client-Side vs. Server-Side A World Without the Same-Origin Policy

Exceptions to the Same-Origin Policy

HTML <script> Element JSON and JSONP iframes and JavaScript document.domain Adobe Flash Player Cross-Domain Policy File Microsoft Silverlight XMLHttpRequest (Ajax) and Cross-Origin Resource Sharing XDomainRequest

Final Thoughts on the Same-Origin Policy

6 Browser Security Principles: Cross-Site Scripting and Cross-Site Request Forgery

Cross-Site Scripting

Cross-Site Scripting Explained Reflected XSS POST-Based Reflected XSS Stored XSS Local XSS Another Variation: HTML Injection XSS Defense: Encoding Output XSS Defense: Sanitizing Input XSS Defense: Using a Reduced Markup Language XSS Defense-in-Depth: HttpOnly XSS Defense-in-Depth: Content Security Policy (CSP) Final Thoughts on Cross-Site Scripting

Cross-Site Request Forgery

Cross-Site Request Forgery Explained HTTP GET and the Concept of Safe Methods Ineffective CSRF Defense: Relying on POST Ineffective CSRF Defense: Checking the Referer Header Ineffective CSRF Defense: URL Rewriting Better CSRF Defense: Shared Secrets Better CSRF Defense: Double-Submitted Cookies Prevent XSS Reauthentication What Being “Logged In” Means Final Thoughts on Cross-Site Request Forgery

7 Database Security Principles

Structured Query Language (SQL) Injection

SQL Injection Effects and Confidentiality-Integrity-Availability The Dangers of Detailed Errors Blind SQL Injection: No Errors Required Solving the Problem: Validating Input Regular Expressions Solving the Problem: Escaping Input

Setting Database Permissions

Single Account Security Separate Accounts for Separate Roles

Stored Procedure Security

The Stored-Procedures-Only Approach: Reducing Permissions Even Further SQL Injection in Stored Procedures

Insecure Direct Object References

No Technical Knowledge Required Insecure Direct Object References and Confidentiality-Integrity-Availability Solving the Problem: Pre- or Post-Request Authorization Checks Final Thoughts on Insecure Direct Object References

8 File Security Principles

Keeping Your Source Code Secret

Static Content and Dynamic Content Revealing Source Code Interpreted versus Compiled Code Backup File Leaks Include-File Leaks Keep Secrets Out of Static Files Exposing Sensitive Functionality

Security Through Obscurity Forceful Browsing

Forceful Browsing and Insecure Direct Object References Directory Enumeration Redirect Workflow Manipulation

Directory Traversal

etc/passwd More Directory Traversal Vulnerabilities Canonicalization

PART III Secure Development and Deployment 9 Secure Development Methodologies

Baking Security In

The Earlier, the Better The Penetrate-and-Patch Approach

The Holistic Approach to Application Security

Training Threat Modeling Secure Coding Libraries Code Review Security Testing Security Incident Response Planning

Industry Standard Secure Development Methodologies and Maturity Models

The Microsoft Security Development Lifecycle (SDL) OWASP Comprehensive Lightweight Application Security Process (CLASP) The Software Assurance Maturity Model (SAMM) The Building Security In Maturity Model (BSIMM) Conclusions on Secure Development Methodologies and Maturity Models

Epilogue The Wizard, the Giant, and the Magic Fruit Trees: A Happy Ending Index

← Prev
Back
Next →

← Prev
Back
Next →