HACK NOTES: WEB SECURITY PORTABLE REFERENCE

By B. FIENO

WEB HACKING & PENETRATION METHODOLOGIES THREATS AND VULNERABILITIES PROFILING THE PLATFORM PROFILING THE APPLICATION SUMMARY CRITICAL HACKS & DEFENSES GENERIC INPUT VALIDATION COMMON VECTORS SOURCE DISCLOSURE CHARACTER ENCODING URL ENCODING (ESCAPED CHARACTERS) UNICODE ALTERNATE REQUEST METHODS SQL INJECTION MICROSOFT SQL SERVER ORACLE MYSQL POSTGRESQL PUTTING IT TOGETHER CROSS-SITE SCRIPTING TOKEN ANALYSIS FINDING TOKENS ENCODED VS ENCRYPTED PATTERN ANALYSIS SESSION ATTACKS SESSION CORRELATION XML-BASED SERVICES ATTACKING XML FUNDAMENTAL APPLICATION DEFENSES INPUT VALIDATION PLATFORM ASSESSMENT METHODOLOGY VULNERABILITY SCANNERS WHISKER AND LIBWHISKER NIKTO NESSUS ASSESSMENT TOOLS ACHILLES WEBPROXY 21 CURL REPLAYING REQUESTS ASSESSMENT & HARDENING CHECKLISTS AN OVERVIEW OF WEB SERVERS LOG FILE CHECKLIST APACHE COMPILE-TIME OPTIONS CONFIGURATION FILE: HTTPDCONF IIS ADSUTILVBS AND THE METABASE ACCOUNTS FILE SECURITY LOGGING IIS LOCKDOWN UTILITY (IISLOCKDEXE) PART III SPECIAL TOPICS ? WEB SERVER SECURITY & ANALYSIS WEB SERVER LOG ANALYSIS PROXIES LOAD BALANCERS THE SCOPE OF AN ATTACK READ OR WRITE ACCESS TO THE FILE SYSTEM ARBITRARY COMMAND EXECUTION SECURE CODING SECURE PROGRAMMING LANGUAGE-SPECIFIC ITEMS JAVA ASP PERL PHP