HACK PROOFING YOUR WEB APPLICATIONS
CONTENTS CHAPTER 1 HACKING METHODOLOGY INTRODUCTION UNDERSTANDING THE TERMS A BRIEF HISTORY OF HACKING PHONE SYSTEM HACKING COMPUTER HACKING WHAT MOTIVATES A HACKER? ETHICAL HACKING VERSUS MALICIOUS HACKING WORKING WITH SECURITY PROFESSIONALS ASSOCIATED RISKS WITH HIRING A SECURITY PROFESSIONAL UNDERSTANDING CURRENT ATTACK TYPES DOS/DDOS VIRUS HACKING TROJAN HORSES WORMS ROGUE APPLETS STEALING CREDIT CARD THEFT THEFT OF IDENTITY INFORMATION PIRACY RECOGNIZING WEB APPLICATION SECURITY THREATS HIDDEN MANIPULATION PARAMETER TAMPERING CROSS-SITE SCRIPTING BUFFER OVERFLOW COOKIE POISONING PREVENTING BREAK-INS BY THINKING LIKE A HACKER SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 HOW TO AVOID BECOMING A “CODE GRINDER” WHAT IS A CODE GRINDER? FOLLOWING THE RULES THINKING CREATIVELY WHEN CODING ALLOWING FOR THOUGHT MODULAR PROGRAMMING DONE CORRECTLY SECURITY FROM THE PERSPECTIVE OF A CODE GRINDER CODING IN A VACUUM BUILDING FUNCTIONAL AND SECURE WEB APPLICATIONS BUT MY CODE IS FUNCTIONAL! THERE IS MORE TO AN APPLICATION THAN FUNCTIONALITY LET’S MAKE IT SECURE AND FUNCTIONAL CHAPTER 3 UNDERSTANDING THE RISKS ASSOCIATED WITH MOBILE CODE RECOGNIZING THE IMPACT OF MOBILE CODE ATTACKS BROWSER ATTACKS MAIL CLIENT ATTACKS MALICIOUS SCRIPTS OR MACROS IDENTIFYING COMMON FORMS OF MOBILE CODE MACRO LANGUAGES:VISUAL BASIC FOR APPLICATIONS (VBA) SECURITY PROBLEMS WITH VBA PROTECTING AGAINST VBA VIRUSES JAVASCRIPT JAVASCRIPT SECURITY OVERVIEW SECURITY PROBLEMS EXPLOITING PLUG-IN COMMANDS WEB-BASED E-MAIL ATTACKS SOCIAL ENGINEERING LOWERING JAVASCRIPT SECURITY RISKS VBSCRIPT VBSCRIPT SECURITY OVERVIEW VBSCRIPT SECURITY PROBLEMS VBSCRIPT SECURITY PRECAUTIONS JAVA APPLETS GRANTING ADDITIONAL ACCESS TO APPLETS SECURITY PROBLEMS WITH JAVA JAVA SECURITY PRECAUTIONS ACTIVEX CONTROLS ACTIVEX SECURITY OVERVIEW SECURITY PROBLEMS WITH ACTIVEX E-MAIL ATTACHMENTS AND DOWNLOADED EXECUTABLES BACK ORIFICE 2000 TROJAN PROTECTING YOUR SYSTEM FROM MOBILE CODE ATTACKS SECURITY APPLICATIONS ACTIVEX MANAGER BACK ORIFICE DETECTORS FIREWALL SOFTWARE WEB-BASED TOOLS IDENTIFYING BAD ACTIVEX CONTROLS CLIENT SECURITY UPDATES CHAPTER 4 VULNERABLE CGI SCRIPTS WHAT IS A CGI SCRIPT, AND WHAT DOES IT DO? TYPICAL USES OF CGI SCRIPTS WHEN SHOULD YOU USE CGI? CGI SCRIPT HOSTING ISSUES BREAK-INS RESULTING FROM WEAK CGI SCRIPTS HOW TO WRITE “TIGHTER” CGI SCRIPTS SEARCHABLE INDEX COMMANDS CGI WRAPPERS WHISKER LANGUAGES FOR WRITING CGI SCRIPTS UNIX SHELL PERL C/C++ VISUAL BASIC ADVANTAGES OF USING CGI SCRIPTS RULES FOR WRITING SECURE CGI SCRIPTS STORING CGI SCRIPTS CHAPTER 5 HACKING TECHNIQUES AND TOOLS A HACKER’S GOALS MINIMIZE THE WARNING SIGNS MAXIMIZE THE ACCESS DAMAGE, DAMAGE, DAMAGE TURNING THE TABLES THE FIVE PHASES OF HACKING CREATING AN ATTACK MAP BUILDING AN EXECUTION PLAN ESTABLISHING A POINT OF ENTRY CONTINUED AND FURTHER ACCESS THE ATTACK SENSITIVE INFORMATION E-MAIL OR MESSAGING SERVICES TELEPHONES AND DOCUMENTS CREDENTIALS THE INTENTIONAL “BACK DOOR”ATTACK HARD-CODING A BACK DOOR PASSWORD EXPLOITING INHERENT WEAKNESSES IN CODE OR PROGRAMMING ENVIRONMENTS THE TOOLS OF THE TRADE HEX EDITORS DEBUGGERS DISASSEMBLERS WINDOWS-BASED TOOLS QUICK VIEW DOS-BASED TOOLS CHAPTER 6 CODE AUDITING AND REVERSE ENGINEERING HOW TO EFFICIENTLY TRACE THROUGH A PROGRAM AUDITING AND REVIEWING SELECTED PROGRAMMING LANGUAGES REVIEWING JAVA REVIEWING JAVA SERVER PAGES REVIEWING ACTIVE SERVER PAGES REVIEWING SERVER SIDE INCLUDES REVIEWING PYTHON REVIEWING TOOL COMMAND LANGUAGE REVIEWING PRACTICAL EXTRACTION AND REPORTING LANGUAGE REVIEWING PHP: HYPERTEXT PREPROCESSOR REVIEWING C/C++ REVIEWING COLDFUSION LOOKING FOR VULNERABILITIES GETTING THE DATA FROM THE USER LOOKING FOR BUFFER OVERFLOWS THE STR* FAMILY OF FUNCTIONS THE STRN* FAMILY OF FUNCTIONS THE *SCANF FAMILY OF FUNCTIONS OTHER FUNCTIONS VULNERABLE TO BUFFER OVERFLOWS CHECKING THE OUTPUT GIVEN TO THE USER FORMAT STRING VULNERABILITIES INFORMATION DISCLOSURE CHECKING FOR FILE SYSTEM ACCESS/INTERACTION CHECKING EXTERNAL PROGRAM AND CODE EXECUTION CALLING EXTERNAL PROGRAMS DYNAMIC CODE EXECUTION EXTERNAL OBJECTS/LIBRARIES CHECKING STRUCTURED QUERY LANGUAGE (SQL)/DATABASE QUERIES CHECKING NETWORKING AND COMMUNICATION STREAMS PULLING IT ALL TOGETHER CHAPTER 7 SECURING YOUR JAVA CODE OVERVIEW OF THE JAVA SECURITY ARCHITECTURE THE JAVA SECURITY MODEL THE SANDBOX SECURITY AND JAVA APPLETS HOW JAVA HANDLES SECURITY CLASS LOADERS THE APPLET CLASS LOADER ADDING SECURITY TO A CUSTOM CLASS LOADER BYTE-CODE VERIFIER JAVA PROTECTED DOMAINS JAVA SECURITY MANAGER POLICY FILES THE SECURITYMANAGER CLASS POTENTIAL WEAKNESSES IN JAVA DOS ATTACK/DEGRADATION OF SERVICE ATTACKS THIRD-PARTY TROJAN HORSE ATTACKS CODING FUNCTIONAL BUT SECURE JAVA APPLETS MESSAGE DIGESTS DIGITAL SIGNATURES GENERATING A KEY PAIR OBTAINING AND VERIFYING A SIGNATURE AUTHENTICATION X509 CERTIFICATE FORMAT OBTAINING DIGITAL CERTIFICATES PROTECTING SECURITY WITH JAR SIGNING ENCRYPTION CRYPTIX INSTALLATION INSTRUCTIONS SUN MICROSYSTEMS RECOMMENDATIONS FOR JAVA SECURITY PRIVILEGED CODE GUIDELINES JAVA CODE GUIDELINES C CODE GUIDELINES CHAPTER 8 SECURING XML DEFINING XML LOGICAL STRUCTURE ELEMENTS ATTRIBUTES WELL-FORMED DOCUMENTS VALID DOCUMENT XML AND XSL/DTD DOCUMENTS XSL USE OF TEMPLATES XSL USE OF PATTERNS DTD SCHEMAS CREATING WEB APPLICATIONS USING XML THE RISKS ASSOCIATED WITH USING XML CONFIDENTIALITY CONCERNS SECURING XML XML ENCRYPTION XML DIGITAL SIGNATURES CHAPTER 9 BUILDING SAFE ACTIVEX INTERNET CONTROLS DANGERS ASSOCIATED WITH USING ACTIVEX AVOIDING COMMON ACTIVEX VULNERABILITIES LESSENING THE IMPACT OF ACTIVEX VULNERABILITIES PROTECTION AT THE NETWORK LEVEL PROTECTION AT THE CLIENT LEVEL METHODOLOGY FOR WRITING SAFE ACTIVEX CONTROLS OBJECT SAFETY SETTINGS SECURING ACTIVEX CONTROLS CONTROL SIGNING USING MICROSOFT AUTHENTICODE CONTROL MARKING USING SAFETY SETTINGS USING IOBJECTSAFETY MARKING THE CONTROL IN THE WINDOWS REGISTRY CHAPTER 10 SECURING COLDFUSION HOW DOES COLDFUSION WORK? UTILIZING THE BENEFIT OF RAPID DEVELOPMENT UNDERSTANDING COLDFUSION MARKUP LANGUAGE SCALABLE DEPLOYMENT OPEN INTEGRATION PRESERVING COLDFUSION SECURITY SECURE DEVELOPMENT CFINCLUDE QUERIES UPLOADED FILES DENIAL OF SERVICE TURNING OFF TAGS SECURE DEPLOYMENT COLDFUSION APPLICATION PROCESSING CHECKING FOR EXISTENCE OF DATA CHECKING DATA TYPES DATA EVALUATION RISKS ASSOCIATED WITH USING COLDFUSION USING ERROR HANDLING PROGRAMS MONITORCFM EXAMPLE USING PER-SESSION TRACKING CHAPTER 11 DEVELOPING SECURITY-ENABLED APPLICATIONS THE BENEFITS OF USING SECURITY-ENABLED APPLICATIONS TYPES OF SECURITY USED IN APPLICATIONS PRETTY GOOD PRIVACY SECURE MULTIPURPOSE INTERNET MAIL EXTENSION SECURE SOCKETS LAYER SERVER AUTHENTICATION CLIENT AUTHENTICATION DIGITAL CERTIFICATES REVIEWING THE BASICS OF PKI CERTIFICATE SERVICES IPLANET BY SUN/NETSCAPE USING PKI TO SECURE WEB APPLICATIONS IMPLEMENTING PKI IN YOUR WEB INFRASTRUCTURE MICROSOFT CERTIFICATE SERVICES NETSCAPE CERTIFICATE SERVER INSTALLATION OF NETSCAPE CERTIFICATE SERVER ADMINISTERING NETSCAPE CMS PKI FOR APACHE SERVER PKI AND SECURE SOFTWARE TOOLKITS TESTING YOUR SECURITY IMPLEMENTATION CHAPTER 12 CRADLE TO GRAVE: WORKING WITH A SECURITY PLAN EXAMINING YOUR CODE CODE REVIEWS PEER-TO-PEER CODE REVIEWS BEING AWARE OF CODE VULNERABILITIES TESTING,TESTING,TESTING USING COMMON SENSE WHEN CODING PLANNING CODING STANDARDS HEADER COMMENTS VARIABLE DECLARATION COMMENTS THE TOOLS RULE-BASED ANALYZERS DEBUGGING AND ERROR HANDLING VERSION CONTROL AND SOURCE CODE TRACKING CREATING A SECURITY PLAN SECURITY PLANNING AT THE NETWORK LEVEL SECURITY PLANNING AT THE APPLICATION LEVEL SECURITY PLANNING AT THE DESKTOP LEVEL WEB APPLICATION SECURITY PROCESS