- Shopping Bag ( 0 items )
Learn how to think like an attacker—and identify potential security issues in your software. In this essential guide, security testing experts offer practical, hands-on guidance and code samples to help you find, classify, and assess ...
Ships from: Belton, MO
Usually ships in 1-2 business days
Learn how to think like an attacker—and identify potential security issues in your software. In this essential guide, security testing experts offer practical, hands-on guidance and code samples to help you find, classify, and assess security bugs before your software is released.
Discover how to:
PLUS—Get code samples and debugging tools on the Web
Chapter 1: General Approach to Security Testing
Chapter 2: Using Threat Models for Security Testing
Chapter 3: Finding Entry Points
Chapter 4: Becoming a Malicious Client
Chapter 5: Becoming a Malicious Server
Chapter 6: Spoofing
Chapter 7: Information Disclosure
Chapter 8: Buffer Overflows and Stack and Heap Manipulation
Chapter 9: Format String Attacks
Chapter 10: HTML Scripting Attacks
Chapter 11: XML Issues
Chapter 12: Canonicalization Issues
Chapter 13: Finding Weak Permissions
Chapter 14: Denial of Service Attacks
Chapter 15: Managed Code Issues
Chapter 16: SQL Injection
Chapter 17: Observation and Reverse Engineering
Chapter 18: ActiveX Repurposing Attacks
Chapter 19: Additional Repurposing Attacks
Chapter 20: Reporting Security Bugs
Tools of the Trade
Security Test Cases Cheat Sheet
Posted February 1, 2007
If you are looking for a great book to start / or to enhance your library on security this is the book. I was looking for a book that brought depth to the subject but didn't assume that I was an expert already. When I browsed this one in the bookstore, I was impressed that it started off with how you should think about testing your application and what the difference is when it comes to security testing. Funny thing now is that when ever I encounter a situation I think about how vulnerable. Believe me, thats pretty scary. The authors proceeded to give a logical path for working toward looking at all the areas where an application might be open to an attack. The authors uses thread models to help flush out the design of an application and explains why they are valuable and how to use them. They then get into looking at entry points and point out areas where you might not realize that you have one. They continue with a discussion on how a malicious client and server could be use to comprise your security. Next they cover ways that someone could fool the user into giving up information such as with spoofing and information disclosure, They then get into discussions about techniques such as buffer overflows, stack and heap manipulation, format string attack and script attacks including XML issues. Along with this you'll find information on permissions, areas for denial of services as well as ActiveX attacks. Finally, you find a very good checklist for doing a systematic approach to checking your security. The topics are well written and provide plenty of examples as well as thoughts about how to deal with the topic. Even if you don't read every chapter there is plenty of information for any particular area that you are interested in. It makes a great book to have on your shelve when you need to brush up or learn about a particular topic. After reading the book, I contacted one of the authors and asked him to present to my team. Yes, I work at the same company but that didn't influence my decision to buy the book especially since it was my own money going to purchase the book. He consented to giving us a presentation and his talk has inspired my entire team to ask for a copy of his book. Being that I had already read about half of it, I knew what he was talking about so it reinforced my opinion of the book. I would say that is a pretty good indication of how good the book is when an entire team asked for a copy. You won't be sorry if you purchase this book.
1 out of 1 people found this review helpful.Was this review helpful? Yes NoThank you for your feedback. Report this reviewThank you, this review has been flagged.