HACK PROOFING XML

By E. GIIRU

CONTENTS CHAPTER 1 THE ZEN OF HACK PROOFING INTRODUCTION LEARNING TO APPRECIATE THE TAO OF THE HACK HACKER CRACKER SCRIPT KIDDIE PHREAKER BLACK HAT,WHITE HAT,WHAT’S THE DIFFERENCE? GRAY HAT THE ROLE OF THE HACKER CRIMINAL MAGICIAN SECURITY PROFESSIONAL CONSUMER ADVOCATE CIVIL RIGHTS ACTIVIST CYBER WARRIOR MOTIVATIONS OF A HACKER RECOGNITION ADMIRATION CURIOSITY POWER AND GAIN REVENGE THE HACKER CODE SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 CLASSES OF ATTACK IDENTIFYING AND UNDERSTANDING THE CLASSES OF ATTACK DENIAL OF SERVICE LOCAL VECTOR DENIAL OF SERVICE NETWORK VECTOR DENIAL OF SERVICE INFORMATION LEAKAGE SERVICE INFORMATION LEAKAGE PROTOCOL INFORMATION LEAKAGE LEAKY BY DESIGN LEAKY WEB SERVERS A HYPOTHETICAL SCENARIO WHY BE CONCERNED WITH INFORMATION LEAKAGE? REGULAR FILE ACCESS PERMISSIONS SYMBOLIC LINK ATTACKS MISINFORMATION STANDARD INTRUSION PROCEDURE SPECIAL FILE/DATABASE ACCESS ATTACKS AGAINST SPECIAL FILES ATTACKS AGAINST DATABASES REMOTE ARBITRARY CODE EXECUTION THE ATTACK CODE EXECUTION LIMITATIONS ELEVATION OF PRIVILEGES REMOTE PRIVILEGE ELEVATION IDENTIFYING METHODS OF TESTING FOR VULNERABILITIES PROOF OF CONCEPT EXPLOIT CODE AUTOMATED SECURITY TOOLS VERSIONING STANDARD RESEARCH TECHNIQUES WHOIS DOMAIN NAME SYSTEM NMAP WEB INDEXING CHAPTER 3 REVIEWING THE FUNDAMENTALS OF XML AN OVERVIEW OF XML THE GOALS OF XML WHAT DOES AN XML DOCUMENT LOOK LIKE? CREATING AN XML DOCUMENT CREATING AN XML DOCUMENT IN VSNET XML DESIGNER EMPTY ELEMENT STRUCTURE OF AN XML DOCUMENT WELL-FORMED XML DOCUMENTS TRANSFORMING XML THROUGH XSLT XSL USE OF PATTERNS XPATH CHAPTER 4 DOCUMENT TYPE: THE VALIDATION GATEWAY DOCUMENT TYPE DEFINITIONS AND WELL-FORMED XML DOCUMENTS SCHEMA AND VALID XML DOCUMENTS XML SCHEMA DATA TYPES LEARNING ABOUT PLAIN-TEXT ATTACKS PLAIN-TEXT ATTACKS EXAMPLE: HTML ESCAPE CODES UNICODE UNDERSTANDING HOW VALIDATION IS PROCESSED IN XML VALIDATE THE INPUT TEXT CANONICALIZATION VALIDATING UNICODE VALIDATE THE DOCUMENT OR MESSAGE IS THE XML WELL FORMED? USING DTDS FOR VERIFYING THE PROPER STRUCTURE USING SCHEMA FOR DATA CONSISTENCY ONLINE VALIDATION METHODS AND MECHANISMS CHAPTER 5 XML DIGITAL SIGNATURES UNDERSTANDING HOW A DIGITAL SIGNATURE WORKS BASIC DIGITAL SIGNATURE AND AUTHENTICATION CONCEPTS WHY A SIGNATURE IS NOT A MAC PUBLIC AND PRIVATE KEYS WHY A SIGNATURE BINDS SOMEONE TO A DOCUMENT LEARNING THE W3C XML DIGITAL SIGNATURE APPLYING XML DIGITAL SIGNATURES TO SECURITY EXAMPLES OF XML SIGNATURES AN ENVELOPING SIGNATURE EXAMPLE AN EXAMPLE OF AN ENVELOPED SIGNATURE A DETACHED SIGNATURE EXAMPLE ALL TOGETHER NOW:AN EXAMPLE OF MULTIPLE REFERENCES SIGNING PARTS OF DOCUMENTS USING XPATH TO TRANSFORM A DOCUMENT USING XSLT TO TRANSFORM A DOCUMENT USING MANIFESTS TO MANAGE LISTS OF SIGNED ELEMENTS REQUIRED AND RECOMMENDED ALGORITHMS CAUTIONS AND PITFALLS VENDOR TOOLKITS CHAPTER 6 ENCRYPTION IN XML UNDERSTANDING THE ROLE OF ENCRYPTION IN MESSAGING SECURITY SECURITY NEEDS OF MESSAGING PRIVACY AND CONFIDENTIALITY AUTHENTICATION AND INTEGRITY NONREPUDIATION ENCRYPTION METHODS AES DES AND 3-DES STREAM AND BLOCK CIPHERS KEY MANAGEMENT SCHEMES LEARNING HOW TO APPLY ENCRYPTION TO XML XML TRANSFORMS BEFORE ENCRYPTION FLOWCHART OF ENCRYPTION PROCESS UNDERSTANDING PRACTICAL USAGE OF ENCRYPTION SIGNING IN PLAIN TEXT, NOT CIPHER TEXT XPATH TRANSFORMS SIGNING THE CIPHER-TEXT VERSION PREVENTS ENCRYPTION KEY CHANGES AUTHENTICATION BY MAC WORKS ON CIPHER TEXT CIPHER TEXT CANNOT VALIDATE PLAIN TEXT ENCRYPTION MIGHT NOT BE COLLISION RESISTANT CHAPTER 7 ROLE-BASED ACCESS CONTROL LEARNING ABOUT STATEFUL INSPECTION PACKET FILTERING APPLICATION LAYER GATEWAY THE FTP PROCESS FIREWALL TECHNOLOGIES AND XML FIRST,YOU INSPECT THE STATE BASELINES EVALUATING STATE CHANGES DEFAULT BEHAVIOR AFFECTS SECURITY LEARNING ABOUT ROLE-BASED ACCESS CONTROL AND TYPE ENFORCEMENT IMPLEMENTATIONS NSA:THE FLASK ARCHITECTURE SELINUX APPLYING ROLE-BASED ACCESS CONTROL IDEAS IN XML KNOW WHEN TO EVALUATE PROTECT DATA INTEGRITY RBAC AND JAVA FENCING IN JAVASCRIPT VALIDATE YOUR JAVA CODE VALIDATE YOUR ACTIVEX OBJECTS TOOLS TO IMPLEMENT RBAC EFFORTS CHAPTER 8 UNDERSTANDING NET AND XML SECURITY THE RISKS ASSOCIATED WITH USING XML IN THE NET FRAMEWORK CONFIDENTIALITY CONCERNS NET INTERNAL SECURITY AS A VIABLE ALTERNATIVE PRINCIPAL AUTHENTICATION AUTHORIZATION SECURITY POLICY TYPE SAFETY CODE ACCESS SECURITY NET CODE ACCESS SECURITY MODEL STACK WALKING CODE IDENTITY CODE GROUPS DECLARATIVE AND IMPERATIVE SECURITY REQUESTING PERMISSIONS DEMANDING PERMISSIONS OVERRIDING SECURITY CHECKS CUSTOM PERMISSIONS ROLE BASED SECURITY PRINCIPALS WINDOWSPRINCIPAL GENERICPRINCIPAL MANIPULATING IDENTITY ROLE-BASED SECURITY CHECKS SECURITY POLICIES CREATING A NEW PERMISSION SET MODIFYING THE CODE GROUP STRUCTURE REMOTING SECURITY CRYPTOGRAPHY SECURITY TOOLS SECURING XML—BEST PRACTICES XML ENCRYPTION XML DIGITAL SIGNATURES CHAPTER 9 REPORTING SECURITY PROBLEMS UNDERSTANDING WHY SECURITY PROBLEMS NEED TO BE REPORTED FULL DISCLOSURE DETERMINING WHEN AND TO WHOM TO REPORT THE PROBLEM WHOM TO REPORT SECURITY PROBLEMS TO? HOW TO REPORT A SECURITY PROBLEM TO A VENDOR DECIDING HOW MUCH DETAIL TO PUBLISH PUBLISHING EXPLOIT CODE PROBLEMS REPERCUSSIONS FROM VENDORS REPORTING ERRORS RISK TO THE PUBLIC