E-raamat: How to Break Web Software: Functional and Security Testing of Web Applications and Web Services

Preface		vii
Acknowledgments		ix
About the Authors		xi
The Web Is Different		1	(10)
What's In This Chapter?		1	(1)
Introduction		1	(1)
The World Wide Web		2	(3)
The Price of Web Utopia		5	(1)
The Web Versus Client-Server		6	(3)
A Fault Model for Web Apps		9	(2)
The Web Server		9	(1)
The Web Client		9	(1)
The Network		10	(1)
Gathering Information on the Target		11	(18)
What's In This Chapter?		11	(1)
Introduction		11	(18)
Attack 1 Panning for Gold		12	(8)
Attack 2 Guessing Files and Directories		20	(6)
Attack 3 Holes Left by Other People---Vulnerabilities in Sample Applications		26	(3)
Attacking the Client		29	(12)
What's In This Chapter?		29	(1)
Introduction		29	(12)
Attack 4 Bypass Restrictions on Input Choices		30	(5)
Attack 5 Bypass Client-Side Validation		35	(6)
State-Based Attacks		41	(24)
What's In This Chapter?		41	(1)
Introduction		41	(24)
Attack 6 Hidden Fields		42	(4)
Attack 7 CGI Parameters		46	(5)
Attack 8 Cookie Poisoning		51	(4)
Attack 9 URL Jumping		55	(4)
Attack 10 Session Hijacking		59	(6)
Attacking User-Supplied Input Data		65	(20)
What's In This Chapter?		65	(1)
Introduction		65	(20)
Attack 11 Cross-Site Scripting		66	(8)
Attack 12 SQL Injection		74	(5)
Attack 13 Directory Traversal		79	(6)
Language-Based Attacks		85	(14)
What's In This Chapter?		85	(1)
Introduction		85	(14)
Attack 14 Buffer Overflows		86	(4)
Attack 15 Canonicalization		90	(5)
Attack 16 Null-String Attacks		95	(4)
Attacking the Server		99	(16)
What's In This Chapter?		99	(1)
Introduction		99	(16)
Attack 17 SQL Injection II---Stored Procedures		100	(3)
Attack 18 Command Injection		103	(3)
Attack 19 Fingerprinting the Server		106	(6)
Attack 20 Denial of Service		112	(3)
Authentication		115	(20)
What's In This Chapter?		115	(1)
Introduction		115	(20)
Attack 21 Fake Cryptography		116	(4)
Attack 22 Breaking Authentication		120	(5)
Attack 23 Cross-Site Tracing		125	(4)
Attack 24 Forcing Weak Cryptography		129	(6)
Privacy		135	(14)
What's In This Chapter?		135	(1)
Introduction		135	(1)
User Agents		136	(3)
Referrer		139	(1)
Cookies		140	(2)
Web Bugs		142	(1)
Clipboard Access		142	(2)
Caching Pages		144	(2)
ActiveX Controls		146	(1)
Browser Helper Objects		146	(3)
Web Services		149	(10)
What's In This Chapter?		149	(1)
Introduction		149	(1)
What Are Web Services?		149	(4)
XML		150	(1)
SOAP		151	(1)
WSDL		152	(1)
UDDI		153	(1)
Threats		153	(6)
WSDL Scanning Attack		153	(2)
Parameter Tampering		155	(1)
XPATH Injection Attack		155	(1)
Recursive Payload Attack		156	(1)
Oversize Payload Attack		157	(1)
External Entity Attack		157	(2)
Appendix A Fifty Years of Software: Key Principles for Quality		159	(12)
1950 to 1959: Genesis		160	(1)
1960 to 1969: Exodus		161	(1)
1970 to 1979: Chaos		162	(1)
1980 to 1989: Repair		163	(2)
Case Tools		163	(1)
Formal Methods		164	(1)
1990 to 1999: Process		165	(2)
2000 to 2009: Engineering?		167	(4)
Appendix B Flowershop Bugs		171	(8)
Appendix C Tools		179	(28)
TextPad		179	(1)
Nikto		180	(3)
Wikto		183	(6)
Stunnel		189	(1)
BlackWidow		190	(3)
Wget		193	(2)
cURL		195	(3)
Paros		198	(2)
SPIKE Proxy		200	(4)
SSLDigger		204	(1)
The Human Brain		205	(2)
Index		207

Mike Andrews is a senior consultant at Foundstone who specializes in software security and leads the Web application security assessments and Ultimate Web Hacking classes. He brings with him a wealth of commercial and educational experience from both sides of the Atlantic and is a widely published author and speaker. Before joining Foundstone, Mike was a freelance consultant and developer of Web-based information systems, working with clients such as The Economist, the London transport authority, and various United Kingdom universities. In 2002, after being an instructor and researcher for a number of years, Mike joined the Florida Institute of Technology as an assistant professor, where he was responsible for research projects and independent security reviews for the Office of Naval Research, Air Force Research Labs, and Microsoft Corporation. Mike holds a Ph.D. in computer science from the University of Kent at Canterbury in the United Kingdom, where his focus was on debugging tools and programmer psychology.

 

James A. Whittaker is a professor of computer science at the Florida Institute of Technology (Florida Tech) and is founder of Security Innovation. In 1992, he earned his Ph.D. in computer science from the University of Tennessee. His research interests are software testing, software security, software vulnerability testing, and anticyber warfare technology. James is the author of How to Break Software (Addison-Wesley, 2002) and coauthor (with Hugh Thompson) of How to Break Software Security (Addison-Wesley, 2003), and over fifty peer-reviewed papers on software development and computer security. He holds patents on various inventions in software testing and defensive security applications and has attracted millions in funding, sponsorship, and license agreements while a professor at Florida Tech. He has also served as a testing and security consultant for Microsoft, IBM, Rational, and many other United States companies.

 

In 2001, James was appointed to Microsofts Trustworthy Computing Academic Advisory Board and was named a Top Scholar by the editors of the Journal of Systems and Software, based on his research publications in software engineering. His research team at Florida Tech is known for its testing technologies and tools, which include the highly acclaimed runtime fault injection tool Holodeck. His research group is also well known for their development of exploits against software security, including cracking encryption, passwords and infiltrating protected networks via novel attacks against software defenses.