| Introduction |
|
xiv | |
|
Part I Anatomy of Vulnerabilities |
|
|
1 | (30) |
|
That Horrible Sinking Feeling |
|
|
3 | (18) |
|
Avoiding That Sinking Feeling |
|
|
4 | (1) |
|
|
|
4 | (1) |
|
What Is Web Application Security? |
|
|
5 | (1) |
|
|
|
5 | (1) |
|
Common Ways Drupal Gets Cracked |
|
|
5 | (14) |
|
Authentication, Authorization, and Sessions |
|
|
6 | (6) |
|
Command Execution: SQL Injection and Friends |
|
|
12 | (4) |
|
|
|
16 | (1) |
|
Cross-Site Request Forgery |
|
|
17 | (2) |
|
|
|
19 | (1) |
|
The Most Common Vulnerabilities |
|
|
19 | (1) |
|
|
|
20 | (1) |
|
Security Principles and Vulnerabilities outside Drupal |
|
|
21 | (10) |
|
Server and Network Vulnerabilities |
|
|
22 | (4) |
|
Weaknesses across the Stack |
|
|
22 | (1) |
|
Denial of Service---Generic and Specific |
|
|
23 | (1) |
|
|
|
23 | (1) |
|
Web Server File System Permissions |
|
|
24 | (1) |
|
Least Privilege---Minimum Permissions for the Task |
|
|
25 | (1) |
|
Least Privilege for Database Accounts |
|
|
25 | (1) |
|
Social and Physical Vulnerabilities |
|
|
26 | (3) |
|
The Vendor Password Please? |
|
|
26 | (1) |
|
|
|
27 | (1) |
|
|
|
28 | (1) |
|
Sanitizing a Typical Drupal Database |
|
|
28 | (1) |
|
|
|
29 | (2) |
|
Part II Protecting against Vulnerabilities |
|
|
31 | (78) |
|
Protecting Your Site with Configuration |
|
|
33 | (16) |
|
Stay Current with Code Updates |
|
|
33 | (5) |
|
Staying Informed about Code Updates |
|
|
34 | (2) |
|
Updating Your Site's Code |
|
|
36 | (2) |
|
|
|
38 | (2) |
|
Best Practices for Contributed Modules |
|
|
38 | (2) |
|
Performing a Quick Security Scan |
|
|
40 | (1) |
|
Using Extra Security Modules |
|
|
40 | (5) |
|
Login and Session-Related Modules |
|
|
41 | (1) |
|
|
|
42 | (2) |
|
|
|
44 | (1) |
|
Smart Configuration of Core |
|
|
45 | (3) |
|
|
|
45 | (1) |
|
Input Formats and Filters |
|
|
45 | (3) |
|
|
|
48 | (1) |
|
Drupal's User and Permissions System |
|
|
49 | (14) |
|
|
|
49 | (2) |
|
What Are Hooks, Form Handlers, and Overrides? |
|
|
51 | (1) |
|
Defining Permissions: hook_perm |
|
|
52 | (1) |
|
Checking Permission: user_access and Friends |
|
|
53 | (4) |
|
Menu Callback Permissions |
|
|
54 | (2) |
|
Input Format Access: filter_access |
|
|
56 | (1) |
|
Common Mistakes with Users and Permissions |
|
|
57 | (4) |
|
Insufficient or Incorrect Menu Access |
|
|
57 | (1) |
|
|
|
58 | (1) |
|
|
|
58 | (1) |
|
Acting as Another User---and Getting Stuck |
|
|
59 | (2) |
|
|
|
61 | (2) |
|
Dangerous Input, Cleaning Output |
|
|
63 | (16) |
|
Database Sanitizing: db_query and Friends |
|
|
63 | (4) |
|
Queries for Drupal 6.x and Earlier |
|
|
64 | (1) |
|
|
|
65 | (1) |
|
Queries for Drupal 7.x and Newer |
|
|
66 | (1) |
|
Translation and Sanitizing: t |
|
|
67 | (1) |
|
|
|
68 | (1) |
|
Linking to Content: I and url |
|
|
69 | (1) |
|
|
|
70 | (4) |
|
Semantic Protection: Invalid Form Data |
|
|
71 | (2) |
|
Form API: Sanitizing Options and Labels |
|
|
73 | (1) |
|
Filtering Content: check_plain, check_markup, filter_xss_admin |
|
|
74 | (4) |
|
Escaping Everything: check_plain |
|
|
75 | (2) |
|
Filtering HTML-Formatted Code: check_markup |
|
|
77 | (1) |
|
Basic Filtering for Admins: filter_xss_admin |
|
|
77 | (1) |
|
|
|
78 | (1) |
|
|
|
79 | (10) |
|
Quick Introduction to Theming in Drupal |
|
|
79 | (4) |
|
Overridable Templates and Functions |
|
|
80 | (2) |
|
Providing Variables for Templates |
|
|
82 | (1) |
|
|
|
83 | (5) |
|
|
|
83 | (3) |
|
Best Practice: Filter Data Prior to Using Templates |
|
|
86 | (2) |
|
|
|
88 | (1) |
|
|
|
89 | (10) |
|
Respecting the Access System |
|
|
90 | (7) |
|
Modifying Queries for Access: db_rewrite_sql |
|
|
90 | (2) |
|
Testing Access for a Single Node: node_access |
|
|
92 | (1) |
|
Case Study: Private Module |
|
|
93 | (1) |
|
Node Access Storage Explained |
|
|
93 | (4) |
|
|
|
97 | (2) |
|
Automated Security Testing |
|
|
99 | (10) |
|
Test Drupal with Drupal: Coder Module |
|
|
100 | (5) |
|
More Testing Drupal with Drupal Security Scanner |
|
|
102 | (3) |
|
Testing Drupal with Grendel-Scan |
|
|
105 | (2) |
|
|
|
107 | (2) |
|
Part III Weaknesses in the Wild |
|
|
109 | (26) |
|
Finding, Exploiting, and Avoiding Vulnerabilities |
|
|
111 | (16) |
|
Strategies to Crack Drupal |
|
|
112 | (1) |
|
Searching Core and Contrib for Vulnerabilities |
|
|
112 | (11) |
|
Using Grep to Search for Common Mistakes |
|
|
112 | (3) |
|
Finding Sites Vulnerable to the Stock Weakness |
|
|
115 | (1) |
|
Finding Vulnerabilities by Happenstance |
|
|
116 | (4) |
|
Exploiting the Talk Module XSS Vulnerability |
|
|
120 | (3) |
|
How to Report Vulnerabilities |
|
|
123 | (1) |
|
|
|
124 | (3) |
|
|
|
127 | (8) |
|
|
|
128 | (2) |
|
|
|
130 | (1) |
|
|
|
131 | (2) |
|
|
|
133 | (1) |
|
|
|
134 | (1) |
|
|
|
135 | (68) |
|
Appendix A Function Reference |
|
|
137 | (10) |
|
|
|
137 | (2) |
|
Link and URL Building Functions |
|
|
139 | (3) |
|
|
|
142 | (2) |
|
|
|
144 | (3) |
|
Appendix B Installing and Using Drupal 6 Fresh out of the Box |
|
|
147 | (50) |
|
Installing Drupal---Easier Than Ever Before |
|
|
149 | (1) |
|
|
|
150 | (1) |
|
Unzipping and Preparing Files for Upload |
|
|
150 | (1) |
|
|
|
150 | (1) |
|
Creating the Database and User for the Drupal Installation |
|
|
151 | (1) |
|
Running the Drupal Installation Wizard |
|
|
151 | (4) |
|
Alternate Method: Managing Drupal with CVS |
|
|
155 | (1) |
|
Updating Drupal Core and Running the Update Script |
|
|
156 | (2) |
|
Designing and Building the Architecture |
|
|
158 | (1) |
|
Application Scope and Domain |
|
|
158 | (2) |
|
|
|
160 | (1) |
|
Installing and Enabling Modules |
|
|
161 | (1) |
|
Making the Site Bilingual |
|
|
162 | (5) |
|
Creating the Business Objects |
|
|
167 | (5) |
|
|
|
172 | (1) |
|
Implementing the Registration Workflow |
|
|
172 | (5) |
|
Implementing the Client's Workflow |
|
|
177 | (7) |
|
Implementing the Translator Team Leader's Workflow |
|
|
184 | (4) |
|
Implementing the Translator's Workflow |
|
|
188 | (7) |
|
Installing the Vulnerable module |
|
|
195 | (1) |
|
|
|
196 | (1) |
|
Appendix C Leveraging Community Resources |
|
|
197 | (6) |
|
Resources from the Drupal Security Team |
|
|
197 | (2) |
|
General Security Resources |
|
|
199 | (1) |
|
|
|
199 | (1) |
|
|
|
199 | (1) |
|
|
|
200 | (1) |
|
|
|
200 | (1) |
|
|
|
201 | (1) |
|
|
|
201 | (1) |
|
|
|
201 | (1) |
|
|
|
202 | (1) |
|
|
|
202 | (1) |
| Glossary |
|
203 | (10) |
| Index |
|
213 | |
Lisainfo e-raamatute kohta