Hunting Security Bugs

( 1 )


Learn how to think like an attacker—and identify potential security issues in your software. In this essential guide, security testing experts offer practical, hands-on guidance and code samples to help you find, classify, and assess ...

See more details below
Available through our Marketplace sellers.
Other sellers (Paperback)
  • All (7) from $2.59   
  • New (2) from $4.99   
  • Used (5) from $2.59   
Sort by
Page 1 of 1
Showing All
Note: Marketplace items are not eligible for any coupons and promotions
Seller since 2010

Feedback rating:



New — never opened or used in original packaging.

Like New — packaging may have been opened. A "Like New" item is suitable to give as a gift.

Very Good — may have minor signs of wear on packaging but item works perfectly and has no damage.

Good — item is in good condition but packaging may have signs of shelf wear/aging or torn packaging. All specific defects should be noted in the Comments section associated with each item.

Acceptable — item is in working order but may show signs of wear such as scratches or torn packaging. All specific defects should be noted in the Comments section associated with each item.

Used — An item that has been opened and may show signs of wear. All specific defects should be noted in the Comments section associated with each item.

Refurbished — A used item that has been renewed or updated and verified to be in proper working condition. Not necessarily completed by the original manufacturer.


Ships from: Monroe Township, NJ

Usually ships in 1-2 business days

  • Canadian
  • International
  • Standard, 48 States
  • Standard (AK, HI)
  • Express, 48 States
  • Express (AK, HI)
Seller since 2009

Feedback rating:


Condition: New
073562187X *BRAND NEW* Ships Same Day or Next!

Ships from: Springfield, VA

Usually ships in 1-2 business days

  • Canadian
  • International
  • Standard, 48 States
  • Standard (AK, HI)
  • Express, 48 States
  • Express (AK, HI)
Page 1 of 1
Showing All
Sort by
Sending request ...


Learn how to think like an attacker—and identify potential security issues in your software. In this essential guide, security testing experts offer practical, hands-on guidance and code samples to help you find, classify, and assess security bugs before your software is released.

Discover how to:

  • Identify high-risk entry points and create test cases
  • Test clients and servers for malicious request/response bugs
  • Use black box and white box approaches to help reveal security vulnerabilities
  • Uncover spoofing issues, including identity and user interface spoofing
  • Detect bugs that can take advantage of your program’s logic, such as SQL injection
  • Test for XML, SOAP, and Web services vulnerabilities
  • Recognize information disclosure and weak permissions issues
  • Identify where attackers can directly manipulate memory
  • Test with alternate data representations to uncover canonicalization issues
  • Expose COM and ActiveX repurposing attacks

PLUS—Get code samples and debugging tools on the Web

Read More Show Less

Product Details

  • ISBN-13: 9780735621879
  • Publisher: Microsoft Press
  • Publication date: 8/30/2006
  • Series: PRO-Developer
  • Edition description: REV
  • Pages: 590
  • Product dimensions: 7.38 (w) x 9.00 (h) x 1.25 (d)

Meet the Author

Tom Gallagher is the lead of the Microsoft® Office Security Test team, where he focuses on penetration testing, writing security testing tools, and providing security education.

Bryan Jeffries is a software engineer responsible for driving security testing on Microsoft® SharePoint® Products and Technologies.

Lawrence Landauer is a software engineer at Microsoft® where he works on coding, testing, and training projects related to security, personal productivity, and deployment.

Read More Show Less

Table of Contents

Who Is This Book For?;
Organization of This Book;
System Requirements;
Technology Updates;
Code Samples and Companion Content;
Support for This Book;
Chapter 1: General Approach to Security Testing;
1.1 Different Types of Security Testers;
1.2 An Approach to Security Testing;
1.3 Summary;
Chapter 2: Using Threat Models for Security Testing;
2.1 Threat Modeling;
2.2 How Testers Can Leverage a Threat Model;
2.3 Data Flow Diagrams;
2.4 Enumeration of Entry Points and Exit Points;
2.5 Enumeration of Threats;
2.6 How Testers Should Use a Completed Threat Model;
2.7 Implementation Rarely Matches the Specification or Threat Model;
2.8 Summary;
Chapter 3: Finding Entry Points;
3.1 Finding and Ranking Entry Points;
3.2 Common Entry Points;
3.3 Summary;
Chapter 4: Becoming a Malicious Client;
4.1 Client/Server Interaction;
4.2 Testing HTTP;
4.3 Testing Specific Network Requests Quickly;
4.4 Testing Tips;
4.5 Summary;
Chapter 5: Becoming a Malicious Server;
5.1 Understanding Common Ways Clients Receive Malicious Server Responses;
5.2 Does SSL Prevent Malicious Server Attacks?;
5.3 Manipulating Server Responses;
5.4 Examples of Malicious Response Bugs;
5.5 Myth: It Is Difficult for an Attacker to Create a Malicious Server;
5.6 Understanding Downgrade MITM Attacks;
5.7 Testing Tips;
5.8 Summary;
Chapter 6: Spoofing;
6.1 Grasping the Importance of Spoofing Issues;
6.2 Finding Spoofing Issues;
6.3 General Spoofing;
6.4 User Interface Spoofing;
6.5 Testing Tips;
6.6 Summary;
Chapter 7: Information Disclosure;
7.1 Problems with Information Disclosure;
7.2 Locating Common Areas of Information Disclosure;
7.3 Identifying Interesting Data;
7.4 Summary;
Chapter 8: Buffer Overflows and Stack and Heap Manipulation;
8.1 Understanding How Overflows Work;
8.2 Testing for Overruns: Where to Look for Cases;
8.3 Black Box (Functional) Testing;
8.4 White Box Testing;
8.5 Additional Topics;
8.6 Testing Tips;
8.7 Summary;
Chapter 9: Format String Attacks;
9.1 What Are Format Strings?;
9.2 Understanding Why Format Strings Are a Problem;
9.3 Testing for Format String Vulnerabilities;
9.4 Walkthrough: Seeing a Format String Attack in Action;
9.5 Testing Tips;
9.6 Summary;
Chapter 10: HTML Scripting Attacks;
10.1 Understanding Reflected Cross-Site Scripting Attacks Against Servers;
10.2 Understanding Persistent XSS Attacks Against Servers;
10.3 Identifying Attackable Data for Reflected and Persistent XSS Attacks;
10.4 Common Ways Programmers Try to Stop Attacks;
10.5 Understanding Reflected XSS Attacks Against Local Files;
10.6 Understanding Script Injection Attacks in the My Computer Zone;
10.7 Ways Programmers Try to Prevent HTML Scripting Attacks;
10.8 Understanding How Internet Explorer Mitigates XSS Attacks Against Local Files;
10.9 Identifying HTML Scripting Vulnerabilities;
10.10 Finding HTML Scripting Bugs Through Code Review;
10.11 Summary;
Chapter 11: XML Issues;
11.1 Testing Non-XML Security Issues in XML Input Files;
11.2 Testing XML-Specific Attacks;
11.3 Simple Object Access Protocol;
11.4 Testing Tips;
11.5 Summary;
Chapter 12: Canonicalization Issues;
12.1 Understanding the Importance of Canonicalization Issues;
12.2 Finding Canonicalization Issues;
12.3 File-Based Canonicalization Issues;
12.4 Web-Based Canonicalization Issues;
12.5 Testing Tips;
12.6 Summary;
Chapter 13: Finding Weak Permissions;
13.1 Understanding the Importance of Permissions;
13.2 Finding Permissions Problems;
13.3 Understanding the Windows Access Control Mechanism;
13.4 Finding and Analyzing Permissions on Objects;
13.5 Recognizing Common Permissions Problems;
13.6 Determining the Accessibility of Objects;
13.7 Other Permissions Considerations;
13.8 Summary;
Chapter 14: Denial of Service Attacks;
14.1 Understanding Types of DoS Attacks;
14.2 Testing Tips;
14.3 Summary;
Chapter 15: Managed Code Issues;
15.1 Dispelling Common Myths About Using Managed Code;
15.2 Understanding the Basics of Code Access Security;
15.3 Finding Problems Using Code Reviews;
15.4 Understanding the Issues of Using APTCA;
15.5 Decompiling .NET Assemblies;
15.6 Testing Tips;
15.7 Summary;
Chapter 16: SQL Injection;
16.1 Exactly What Is SQL Injection?;
16.2 Understanding the Importance of SQL Injection;
16.3 Finding SQL Injection Issues;
16.4 Avoiding Common Mistakes About SQL Injection;
16.5 Understanding Repurposing of SQL Stored Procedures;
16.6 Recognizing Similar Injection Attacks;
16.7 Testing Tips;
16.8 Summary;
Chapter 17: Observation and Reverse Engineering;
17.1 Observation Without a Debugger or Disassembler;
17.2 Using a Debugger to Trace Program Execution and Change its Behavior;
17.3 Using a Decompiler or Disassembler to Reverse Engineer a Program;
17.4 Analyzing Security Updates;
17.5 Testing Tips;
17.6 Legal Considerations;
17.7 Summary;
Chapter 18: ActiveX Repurposing Attacks;
18.1 Understanding ActiveX Controls;
18.2 ActiveX Control Testing Walkthrough;
18.3 Testing Tips;
18.4 Summary;
Chapter 19: Additional Repurposing Attacks;
19.1 Understanding Document Formats That Request External Data;
19.2 Web Pages Requesting External Data;
19.3 Understanding Repurposing of Window and Thread Messages;
19.4 Summary;
Chapter 20: Reporting Security Bugs;
20.1 Reporting the Issue;
20.2 Contacting the Vendor;
20.3 What to Expect After Contacting the Vendor;
20.4 Public Disclosure;
20.5 Addressing Security Bugs in Your Product;
20.6 Summary;
Tools of the Trade;
Code Analysis;
Documents and Binaries;
Security Test Cases Cheat Sheet;
Network Requests and Responses;
Information Disclosures;
Buffer Overflows;
Format Strings;
Cross-Site Scripting and Script Injection;
Canonicalization Issues;
Weak Permissions;
Denial of Service;
Managed Code;
SQL Injection;
Tom Gallagher;
Bryan Jeffries;
Lawrence Landauer;

Read More Show Less

Customer Reviews

Average Rating 5
( 1 )
Rating Distribution

5 Star


4 Star


3 Star


2 Star


1 Star


Your Rating:

Your Name: Create a Pen Name or

Barnes & Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation


  • - By submitting a review, you grant to Barnes & and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Terms of Use.
  • - Barnes & reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously
Sort by: Showing 1 Customer Reviews
  • Anonymous

    Posted February 1, 2007

    Great book on learning about software security

    If you are looking for a great book to start / or to enhance your library on security this is the book. I was looking for a book that brought depth to the subject but didn't assume that I was an expert already. When I browsed this one in the bookstore, I was impressed that it started off with how you should think about testing your application and what the difference is when it comes to security testing. Funny thing now is that when ever I encounter a situation I think about how vulnerable. Believe me, thats pretty scary. The authors proceeded to give a logical path for working toward looking at all the areas where an application might be open to an attack. The authors uses thread models to help flush out the design of an application and explains why they are valuable and how to use them. They then get into looking at entry points and point out areas where you might not realize that you have one. They continue with a discussion on how a malicious client and server could be use to comprise your security. Next they cover ways that someone could fool the user into giving up information such as with spoofing and information disclosure, They then get into discussions about techniques such as buffer overflows, stack and heap manipulation, format string attack and script attacks including XML issues. Along with this you'll find information on permissions, areas for denial of services as well as ActiveX attacks. Finally, you find a very good checklist for doing a systematic approach to checking your security. The topics are well written and provide plenty of examples as well as thoughts about how to deal with the topic. Even if you don't read every chapter there is plenty of information for any particular area that you are interested in. It makes a great book to have on your shelve when you need to brush up or learn about a particular topic. After reading the book, I contacted one of the authors and asked him to present to my team. Yes, I work at the same company but that didn't influence my decision to buy the book especially since it was my own money going to purchase the book. He consented to giving us a presentation and his talk has inspired my entire team to ask for a copy of his book. Being that I had already read about half of it, I knew what he was talking about so it reinforced my opinion of the book. I would say that is a pretty good indication of how good the book is when an entire team asked for a copy. You won't be sorry if you purchase this book.

    1 out of 1 people found this review helpful.

    Was this review helpful? Yes  No   Report this review
Sort by: Showing 1 Customer Reviews

If you find inappropriate content, please report it to Barnes & Noble
Why is this product inappropriate?
Comments (optional)