Other Sellers on Amazon
Follow the Author
The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws Paperback – Illustrated, 9 September 2011
Enhance your purchase
Web applications are the front door to most organizations, exposing them to attacks that may disclose personal information, execute fraudulent transactions, or compromise ordinary users. This practical book has been completely updated and revised to discuss the latest step-by-step techniques for attacking and defending the range of ever-evolving web applications. You'll explore the various new technologies employed in web applications that have appeared since the first edition and review the new attack techniques that have been developed, particularly in relation to the client side.
- Reveals how to overcome the new technologies and techniques aimed at defending web applications against attacks that have appeared since the previous edition
- Discusses new remoting frameworks, HTML5, cross-domain integration techniques, UI redress, framebusting, HTTP parameter pollution, hybrid file attacks, and more
- Features a companion web site hosted by the authors that allows readers to try out the attacks described, gives answers to the questions that are posed at the end of each chapter, and provides a summarized methodology and checklist of tasks
Focusing on the areas of web application security where things have changed in recent years, this book is the most current resource on the critical topic of discovering, exploiting, and preventing web application security flaws.
From the Publisher
From the Publisher
MARCUS PINTO delivers security consultancy and training on web application attack and defense to leading global organizations in the financial, government, telecom, gaming, and retail sectors.
The authors cofounded MDSec, a consulting company that provides training in attack and defense-based security.
From the Inside Flap
Web applications are everywhere, and they're insecure. Banks, retailers, and others have deployed millions of applications that are full of holes, allowing attackers to steal personal data, carry out fraud, and compromise other systems. This book shows you how they do it.
This fully updated edition contains the very latest attack techniques and countermeasures, showing you how to break into today's complex and highly functional applications. Roll up your sleeves and dig in.
Discover how cloud architectures and social networking have added exploitable attack surfaces to applications
Leverage the latest HTML features to deliver powerful cross-site scripting attacks
Deliver new injection exploits, including XML external entity and HTTP parameter pollution attacks
Learn how to break encrypted session tokens and other sensitive data found in cloud services
Discover how technologies like HTML5, REST, CSS and JSON can be exploited to attack applications and compromise users
Learn new techniques for automating attacksand dealing with CAPTCHAs and cross-site request forgery tokens
Steal sensitive data across domains using seemingly harmless application functions and new browser features
Find help and resources at http://mdsec.net/wahh
Source code for some of the scripts in the book
Links to tools and other resources
A checklist of tasks involved in most attacks
Answers to the questions posed in each chapter
Hundreds of interactive vulnerability labs
- Publisher : Wiley; 2 edition (9 September 2011)
- Language : English
- Paperback : 912 pages
- ISBN-10 : 1118026470
- ISBN-13 : 978-1118026472
- Dimensions : 18.8 x 5.08 x 23.11 cm
- Best Sellers Rank: 56,486 in Books (See Top 100 in Books)
- Customer Reviews:
About the author
Review this product
Top review from Australia
Top reviews from other countries
While on a first read-through it was not possible to take everything in, I found this to be highly accessible for a technical book. The writing style was quite casual. Examples are made from an informed perspective and relevant background for every exploit was presented in an understandable way.
This is not a "cook-book" of ready to use exploits, but more an explanation of the mind-set required to develop your own exploits and a presentation of the background to specific circumstances that allow such exploits.
I have to say that this is an old book considering the pace of technological advancement and reference is made to deprecated technologies such as Flash and Silverlight, but as a primer, a historical snapshot and an introduction to the mind-set required to effectively use exploits in general, this was a very good read.
Don't expect to sit down and have an easy time, this is a technical book and I found it challenging in this respect, but I am extremely glad I decided to purchase this book and read it cover-to-cover.
I would say this book is best read while dividing time with more current resources such as the Portswigger Academy, labs provided by sites such as TryHackMe, etc.
Dafydd Stuttard, one of the authors, is the core developer of BurpSuite (by Portswigger), and reading this summary of the web hacking landscape has given me a new perspective on this world-leading application.
I would strongly recommend this to anyone interested in web hacking specifically, but also hacking in general.
I think as time goes on, the book will become even more useful for me. For the price and the staggering amount of detail and information, it's a no-brainer. This is basically a fantastic reference book and knowledge-base for anyone who is serious about digital security.
While reading the book i found it was quite dry because i was not doing the practical excersises available online. As you have to pay for them i wasn't sure if it would be worth it. With hindsight after doing the course i would highly recommend using them. It will make the content a lot more interesting but also teach a key skill which the book doesn't:
The key to most pen testing and vulnerability research is persistence and logical thinking. It is very well to think you know how a certain bug works but it can still be quite a challenge to actually implement it.
I feel very lucky to have been able to attend the live course for hands on help from the authors but you can definitely get all the information and practice you need purely from the book and the website. Its a shame that there isn't a couple of hours of practical time included when you buy the book.
It is very well written and covers all the areas you would expect. A lot of the old school web bugs explained such as SQL injection and less common now because of better programming practices and interfaces. Later chapters in the book such as the methodologies and logic flaw errors are timeless.
The book also provides real world solutions and mitigation's for the attacks described so this is highly recommended for anyone who develops web applications swell as people who carry out penetration testing on them.
While this may not be the best book ever written i think it definitively describes the topic therefore i have given it 5 stars.