Customer Reviews

How to Break Web Software: Functional and Security Testing of Web Applications and Web Services

5 star:		(9)
4 star:		(4)
3 star:		(1)
2 star:		(1)
1 star:		(0)

 

 

I recently finished reading How to Break Web Software: Functional and Security Testing of Web Applications and Web Services by Mike Andrews and James A. Whittaker. I, like many of you, develop web software for a living. I've always taken security seriously and occasionally sneered when I ran across examples of common mistakes. Having said that, this book was an eye opener for me.

The book covers common exploits such as bypassing input validation, SQL injection, and denial of service. There were also several types of attacks I hadn't really considered before. I won't list them here because someone would undoubtedly say, "I can't believe he didn't know about that one!" The authors cover 24 different types of attacks in all. The book also includes coverage of web privacy issues and security related to web services.

Finally, as icing on the cake, a CD is included that contains many tools that will find permanent spots in your arsenal. There are tools to do things like scan web servers for common exploits, mirror sites for local analysis, and check SSL cipher strengths. My favorites are the local proxies that will allow you to view and modify posts as they travel from the client and the server. I always knew I could do this, but didn't know how easy it is. The CD also contains the source code of an example site that includes many flaws for you to practice.

This book is written for software professionals to help them put the hackers out of business. So, it necessarily includes hacker techniques. If you develop or test web software, you should read this book before the hackers do. :-)

This is a hard topic to find good reading. Most books are usually targeted towards operating systems or malware specifically. However, from the first page, I knew this was something worthwhile. A key part to this book being so good is the format Mike and James use to present each topic thus providing something for attackers and security folks. It also could provide pen testers and auditors some good ammo to use as well.

The layout of the chapters starts with gathering information on targets. Then takes a step towards client side attacks, server side attacks, Language based attacks, Authentication, Privacy, and Web Services. They even throw in a chapter outlining the last 50 years or so of web software defects. Surprisingly, or not so surprisingly, we have not always learned from our mistakes.

The best part of the book however, is not the topic as much as it is the layout they use to demonstrate every vulnerability. They start with a topic, Buffer Overflows as an example. The authors describe what it is in a few paragraphs, then discuss when to apply this type of attack, then proceed in How to conduct this attack, and end with How to protect oneself from this attack. Each section is no more than a few paragraphs, ensuring that you do not loose focus on what's being discussed.

The authors also do a great job discussing the tools that one can use to test or perform each attack. Tools such as Nikto, Wikto, Paros and SSL Digger are discussed. When additional information is needed, they provide screenshots and output for one to learn from.

This book is a must for anyone in the role of Web Security, Auditing, or pen testing.

Pros
Good Tools, Excellent format, Easy to read

Cons
Perhaps more references for more information since the authors do not go into great detail; Advanced web security people may find it a bit elementary

You can't really read a book like this. You read a few pages and prop the book up with a cookbook holder and start typing in the examples. There were a couple I could not duplicate, but almost everything worked as the authors said it would. Great book, or maybe it would be better to say, great tool!

The fun starts with chapter 2 and these folks do not spend a lot of time on reconnaisance. They know how to break web software and we start on that by chapter 3. I was a little sad in chapter 5, they did not really do SQL injection justice, but then they hit it again with stored procedures in chapter 7.

If there is a weakness to the book it might be chapter 9 and 10, the ending, but I still found both chapters informative.

Every large organization I know is building web applications and most of them are doing it badly. If you are a coder, a webmaster, or a manager of any of the above, buy a copy of this book for everyone on your team. I am going to do the same for my team right now.

This is a focussed book with a single aim; to help you find and correct common vulnerabilities in web-based applications and website software.

Above all, this is a book to be used. The authors take a practical approach to each area of consideration, and the chapters are well structured to make it easy for you to get right to work.

For each area they provide an informative overview followed by discussion of the vulnerabilities including numerous code snippets, examples and screen shots. Though rich in detail the writing style keeps you engaged and the sensible structure (when to apply the attack, how to perform it and how to protect against it) makes it easy to grasp the key points.

There is no bias towards either Windows or Unix products on either the client or the server, and you won't need to be a scripting expert to put the authors' ideas into practice.

Chapter 1 explains the difference between web-based and traditional client-server systems and why a different approach is needed when testing. Subsequent chapters cover the vulnerabilities:

Gathering Information on the Target

Bypassing Client-Side Validation

State-Based Attacks
Including Hidden Fields, Cookie poisoning and Session Hijacking

Data Attacks
Including Cross-Site Scripting, SQL Injection and Directory Traversal

Language-Based Attacks
Including Buffer Overflows

Server Attacks
Including Stored Procedures, SQL Injection, Server Fingerprinting and Denial of Service

Authentication
Including Weak Cryptography and Cross-Site Tracing

Privacy
Including Caching, Cookies, Web Bugs, ActiveX Controls and Browser Help Objects

Web Services
Including WSDL and XML attacks

The book comes with an excellent companion CD containing a number of testing tools and a flawed website on which you can use the techniques you have learned to cement your knowledge. Both the tools and the vulnerabilities in the sample site are fully documented in two useful appendices.

All in all, a rich and well-focussed yet accessible introduction to a wide-ranging subject. If the security of web-based applications is your area, make room for this on your bookshelf.

I was disappointed in this book. The actual content was pretty thin, and not very well written. Chapter 1 is a complete waste of time, and actually spends pages explaining what client/server means, what the Web is, and other things that are patently obvious to the supposed audience for this material. I found myself turning to the front to see if this book was written in 1997! You then get nine fairly short chapters with instructions on how to hack a website, more or less; followed by 50 pages of useless padding in the appendices including: an unrelated article co-authored by Whittaker for the IEEE, a detailed list of all the bugs present in their "sample application," and then descriptions of their recommended tools, all of which can easily be found on the Web without paying $22 for this book.

As another reviewer mentioned, there are many typos and other problems like incorrect illustrations, making the reader wonder if Addison-Wesley even employs a copy editor. Furthermore, I felt this book was inaccurately named and described. It's really more about rudimentary hacking and protecting your web application against hackers than web quality or web testing. A beginning web developer might do well to read this as a primer on how to create sites and applications with basic security, but as an experienced tester it was of limited use to me.

This is an interesting book to read, specially to QA engineers like me, it covers most of the important topics in web application security. Also, with a CD containing tools used for applying attacks described in the book.

Very nice book, He covers topics that i never even thought of. Highly recommended

If you write external-facing web apps, just accept the fact that someone will try to hack them. The best you can do is to be aware of the different ways that web apps can be broken, and then use those techniques in your testing. Better you find them first before "they" do. I got a review copy of How to Break Web Software: Functional and Security Testing of Web Applications and Web Services by Mike Andrews and James A. Whittaker. Excellent book...

Contents: The Web Is Different; Gathering Information on the Web; Attacking the Client; State-Based Attacks; Attacking User-Supplied Input Data; Language-Based Attacks; Attacking the Server; Authentication; Privacy; Web Services; Fifty Years of Software: Key Principles for Quality; Flowershop Bugs; Tools; Index

Along with the general information on how web-based applications differ from client-based apps, the authors cover 24 specific attacks with detailed examples on how they work. For instance, I was aware of SQL Injection attacks, but they show an example in there that is a twist I hadn't seen before and that is downright scary. My guess is that there's a lot of data at risk by companies who don't have a clue. There's a CD in the back of the book that contains a number of the tools they use to do their vulnerability testing, and that's almost worth the price of the book alone. For instance, there's Brutus... a brute-force authentication tool. I had also never heard of HTTPrint, which is a tool that targets a server and uses a number of tests to "fingerprint" it and determine the operating system and other items of interest. If you're serious about testing your web applications and securing them against unintended use, then it's best you have these software gems at your disposal. You know the other side already does. Once you understand how your applications can be manipulated, you can become a much better developer by building in security at a foundational layer. For instance, don't trust your JavaScript client side editing routines to validate your data. That input can be changed and sent back to the server. Instead, have input validation both at the client *and* at the server to make sure no data manipulation or validation bypasses were used. Simple stuff like that can save you a ton of headaches and grief down the road.

With the cost of privacy lapses running into the millions for companies who fail in that area, you can't afford *not* to take the time to learn how to write and test secure applications. This may well be the best $35 you ever spent on your professional development. Consider it "job insurance" to avoid having to look for another job because your application ended up as a case study in some IT magazine...

If your company has a web site, there are many people waiting to attack it and break into it.

In How to Break Web Software: Functional and Security Testing of Web Applications and Web Services, authors Mike Andrews and James Whittaker detail the myriad Web software exploits that attackers will attempt to carry out. The tools and techniques that can be used to fight against them are also detailed.

The book also includes a companion CD that contains all of the source code referenced in the book in addition to a number of testing tools. The authors include software code from an insecure Web site, which helps the reader get a real-world feel for the topics involved.

The authors conclude with a look at the last 50 years of software defects, showing that developers are not learning from the mistakes.

The authors are of the opinion that software quality is no better today than it was decades ago. And in some cases, it is worse.

The book helps drive home the importance of having developers think about writing secure code and testing it for flaws. It is a recommended read for IT professionals.

The introduction of this book states that Gopher was created at the University of Michigan. Not so! It was created at the University of Minnesota. I believe the authors owe the Golden Gophers an apology!
That appalling error aside, the book covers the topic well.