The Web Application Hacker's Handbook: Discovering and Exploiting Security Flaws 1st Edition

by Dafydd Stuttard (Author), Marcus Pinto (Author)

30 customer reviews

ISBN-13: 978-0470170779

ISBN-10: 0470170778

Why is ISBN important?

Have one to sell? Sell on Amazon

Added to

Unable to add item to List. Please try again.

Share <Embed>

Buy used

$12.24

Condition: Used - Good

In Stock. Sold by Jenson Books Inc, Fulfilled by Amazon

Access codes and supplements are not guaranteed with used items.

34 Used from $3.99

FREE Shipping on orders over $25.

Deliver to

Turn on 1-Click ordering

More Buying Choices

5 New from $34.90 34 Used from $3.99 1 Collectible from $38.89

40 used & new from $3.99

See All Buying Options

There is a newer edition of this item:

The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws
$36.08
(75)
In Stock.

Free%20Two-Day%20Shipping%20for%20College%20Students%20with%20Amazon%20Student

This book is a practical guide to discovering and exploiting security flaws in web applications. The authors explain each category of vulnerability using real-world examples, screen shots and code extracts. The book is extremely practical in focus, and describes in detail the steps involved in detecting and exploiting each kind of security weakness found within a variety of applications such as online banking, e-commerce and other web applications.

The topics covered include bypassing login mechanisms, injecting code, exploiting logic flaws and compromising other users. Because every web application is different, attacking them entails bringing to bear various general principles, techniques and experience in an imaginative way. The most successful hackers go beyond this, and find ways to automate their bespoke attacks. This handbook describes a proven methodology that combines the virtues of human intelligence and computerized brute force, often with devastating results.

The authors are professional penetration testers who have been involved in web application security for nearly a decade. They have presented training courses at the Black Hat security conferences throughout the world. Under the alias "PortSwigger", Dafydd developed the popular Burp Suite of web application hack tools.

Customers who bought this item also bought

Page 1 of 1 Start overPage 1 of 1

This shopping feature will continue to load items. In order to navigate out of this carousel please use your heading shortcut key to navigate to the next or previous heading.

Ben Clark

470

Paperback
$9.00
Peter Kim

134

Paperback
$22.49
David Kennedy

122

Paperback
$41.92
Dafydd Stuttard

75

Paperback
$36.08
Justin Seitz

85

Paperback
$27.96
Alan J White

93

Paperback
$13.49

Customers who viewed this item also viewed

Page 1 of 1 Start overPage 1 of 1

This shopping feature will continue to load items. In order to navigate out of this carousel please use your heading shortcut key to navigate to the next or previous heading.

Dafydd Stuttard

75

Paperback
$36.08
Peter Kim

48

Paperback
$26.96
Ben Clark

470

Paperback
$9.00
Jon Erickson

236

Paperback
$33.96
Michal Zalewski

35

Paperback
$59.92
Akash Mahajan

8

Paperback
$25.99

Editorial Reviews

Review

"If you have an interest in web application security, I would highly recommend picking up a copy of this book, especially if you’re interested in being able to audit applications for vulnerabilities".
—Robert Wesley McGrew, McGrew Security

From the Back Cover

Hack the planet

Web applications are everywhere, and they're insecure. Banks, retailers, and others have deployed millions of applications that are full of holes, allowing attackers to steal personal data, carry out fraud, and compromise other systems. This innovative book shows you how they do it.

This is hands-on stuff. The authors, recognized experts in security testing, take a practical approach, showing you the detailed steps involved in finding and exploiting security flaws in web applications. You will learn to:

Defeat an application's core defense mechanisms and gain unauthorized access, even to the most apparently secure applications
Map attack surfaces and recognize potential entry points
Break client-side controls implemented within HTML, Java®, ActiveX®, and Flash®
Uncover subtle logic flaws that leave applications exposed
Use automation to speed up your attacks, with devastating results
Delve into source code and spot common vulnerabilities in languages like C#, Java, and PHP

Know your enemy

To defend an application, you must first know its weaknesses. If you design or maintain web applications, this book will arm you with the protective measures you need to prevent all of the attacks described. If you're a developer, it will show you exactly where and how to strengthen your defenses.

Additional resources online at www.wiley.com/go/webhacker

Source code for scripts in this book
Links to tools and resources
Checklist of tasks involved in attacking applications
Answers to the questions posed in each chapter
A hacking challenge prepared by the authors

See all Editorial Reviews

Product details

Paperback: 768 pages
Publisher: Wiley; 1 edition (October 22, 2007)
Language: English
ISBN-10: 0470170778
ISBN-13: 978-0470170779
Product Dimensions: 7.4 x 1.6 x 9.2 inches
Shipping Weight: 2.4 pounds
Average Customer Review: 30 customer reviews
Amazon Best Sellers Rank: #613,083 in Books (See Top 100 in Books)
- #110 in Books > Computers & Technology > Certification > CompTIA
- #312 in Books > Computers & Technology > Security & Encryption > Privacy & Online Safety
- #531 in Books > Computers & Technology > Internet & Social Media > Hacking

Would you like to tell us about a lower price?
If you are a seller for this product, would you like to suggest updates through seller support?

Be the first video

Your name here

Important information

Ingredients

Example Ingredients

Directions

Example Directions

Customer reviews

1 star (0%)

Write a customer review

See all 30 customer reviews

Top customer reviews

There was a problem filtering reviews right now. Please try again later.

W. Wiencke

Must reading if you write web pages

July 4, 2013

Verified Purchase

Skip this review and avoid this book if you use site building kits like WordPress -- or you don't care about your site getting hacked.

Get the book if you are not keen on vulnerable cookie-cutter code and hacker prone pages.

The "take away" from this book is that a site author has to take a system wide look a the site -- particularly if there is an interaction between the visitor and the server.

This book takes the position that any one who uses server side includes (SSI) or client side scripts like JavaScript must be aware of the mechanisms by which the browser and server interact.

The book looks at the spectrum of tools available to inspect, analyze and even alter the data flowing between the visitor's browser and the site's server. It doesn't take long to realize that if someone has the tools and wants to spend the time practically any transaction between a browser and server is vulnerable.

OK, if you've read this far you already appreciate the value of defensive programming to make software maintainable. What this book gives you is solid examples of what you have to look out for. There's the obvious blunders like stashing key variables in cookies where the hacker can diddle them. But there are subtleties like how a SSI error message can guide a hacker script to discover an ID or password.

This is a "must read" book for someone who has a command of HTML, JavaScript, and one of the server side scripting languages like Perl, PHP, or ASF. The book forced me to even more critically rethink my programming habits.

,

2 people found this helpful3 people found this helpful

Helpful

Comment

Kindle Customer John

The Web Application Hacker's Handbook....

January 28, 2017

Verified Purchase

Arrived quickly and in good condition. it is a used library book but is in fine condition. Slightly outdated but part are very useful in my basic studies and help me, hopefully, in strengthening my home network security. At the least it is good learning more about network and TCP/IP Internet stuff. Interesting to find out what people know and do. Some of this information is probably illegal in some places so use it for knowledge about what these kinds of people know and can do to hack into your networks. Strengthening your websites would be the most benefit from reading this book most likely. It's so technical that I may never finish it.

One person found this helpful

Helpful

Comment

Garot M. Conklin

Best text on subject

December 4, 2007

Verified Purchase

This is by far the best text I have ever come across on the topic of web application vulnerability exploits. Although this is a 10+ year old topic, it is just now moving to the forefront of security professionals minds everywhere. This book goes into extreme detail and theory on every facet of web application exploitation that I have or have not heard of in my experience. At times it was a bit beyond my understanding as I am not a professional coder but it was still reasonably clear where the author was going. Hey, it's not his fault I am not at the same level right? Which is why I am reading his book. If you are not familiar with the Burpe suite of tools, and you should be if you are considering reading this book, the author is also the author of that application. So it is used or referenced in the book often. It is a GREAT tool set for this type of assessment. If you don't have it... get it... it is FREE and you will need something to follow along and try out the examples as they are presented, which is exactly how I recommend you read this book. There is so much presented that if you do not actually try out each scenario when it is presented in the text you will not remember it by the end of the chapter. The only thing that I would have liked to have seen was the use of a specific exploit from start to finish. If you read any of my other book reviews on similar topics, you will know that I say this in every review. No one does this. Why? I have no idea. It is painfully clear that the author can carry out these exploits, why not show one from start to finish. From the initial thought process or feeling you get when you go to a site and just "know" something is not right. Someone needs to walk people through a real exploit, that is hopefully patched now, step by step. This is essential to the mass learning process. Not everyone can extract this information and "know-how" from all theory and vague examples. Even in this great book they missed the boat there. I guess the problem is that it takes a great deal of time to really develop to the point of the author or any other similar professional, however security professionals need this information and know-how today, not next year, to really make an impact on this form of exploitation. Often many organizations do not have the resources or cannot justify the resources to put an expert(s) into this position, so they call upon an existing staff member to fill the role. That staff member needs to be up to speed now, immediately. This is just my opinion, but hey... what do I know right?

5 people found this helpful6 people found this helpful

Helpful

Comment

Pages with related products. See and discover other items: web application security, web testing, power query