15 of 15 people found the following review helpful:
4.0 out of 5 stars
A good book, but lacking some of what I like about the HE series, March 31, 2011
This review is from: HACKING EXPOSED WEB APPLICATIONS, 3rd Edition (Paperback)
This is the third Hacking Exposed: Web Applications (HE:WA) book I've reviewed, having reviewed the second edition in 2006 and the first edition in 2002. While I gave the earlier editions each five stars, I don't think HE:WA3E quite meets my expectations of a five star web application security book -- at least not one bearing the Hacking Exposed (HE) series name.
In my opinion, the winning formula for a good HE book was set by the first in the series, back in 1999: 1) explain a technology of interest; 2) show exactly how to exploit it; 3) recommend countermeasures. For me, these three steps MUST be followed, and any book with HE in the title that fails to follow this recipe is likely to fall flat. The reason I like this approach is simple; in many cases, defenders first encounter a new technology only after a researcher or intruder has broken it! In other words, the offensive side is usually far ahead of the defensive side, because offenders often specialize in a promising new area and pursue it relentlessly until they break it. Good HE books help redress this imbalance by getting the defender up to speed on a new technology, showing how to break it, and then suggesting defensive measures.
I believe that while HE:WA3E adopts some of this approach, it seems to not be consistently applied. In fact, I'm wondering if the absence of Mike Shema from the author team could be the reason for this change. Mike's handiwork still appears as a legacy of using older material, but elsewhere I found myself missing the HE formula.
For example, ch 9 seems to diverge from the HE recipe. It also seemed "light" to me compared to the prevalence of client-side exploitation. When HE:WA2E arrived in 2006, client-side attacks had been popular for about three years. I would have expected HE:WA3E (even though it's a "Web apps" book) to spend much more time on exploiting Web clients given the events of the past five years.
If you're wondering how the contents of HE:WA3E compare to HE:WA2E, it appears that concepts from the old ch 7 "Attacking Web Datastores" now appears in ch 6 ("Input Injection Attacks"), and ch 11 "Denial of Service (DoS) Attacks" is gone. I could tell when some material was repeated, but in other areas I could see updates (mention of the SHODAN search engine -- though not the "full details" listed on the back cover! -- for example).
Content-wise, the authors appeared to know a lot about their subject. Since I know all three from their conference appearances, I was confident in their expertise. One small note: I was disappointed by the screen shots in ch 10. The authors should keep in mind that screen captures from high resolution monitors do not translate well in print, especially when the images are fuzzy or very small.
Overall, I like HE:WA3E, but I hope to see a fourth edition return to the winning HE formula. I'd also like to see the authors take a look at some of the competing Web security books to see where they could differentiate to add even more value.
Help other customers find the most helpful reviews
Was this review helpful to you? Yes
No
