How we did it:
For any feedback, any questions, any notes or just for chat - feel free to follow us on social networks
Dafydd Stuttard, Marcus Pinto
This book is a practical guide to discovering and exploiting security flaws in web applications. The authors explain each category of vulnerability using real-world examples, screen shots and code extracts. The book is extremely practical in focus, and describes in detail the steps involved in detecting and exploiting each kind of security weakness found within a variety of applications such as online banking, e-commerce and other web applications. The topics covered include bypassing login mechanisms, injecting code, exploiting logic flaws and compromising other users. Because every web application is different, attacking them entails bringing to bear various general principles, techniques and experience in an imaginative way. The most successful hackers go beyond this, and find ways to automate their bespoke attacks. This handbook describes a proven methodology that combines the virtues of human intelligence and computerized brute force, often with devastating results. The authors are professional penetration testers who have been involved in web application security for nearly a decade. They have presented training courses at the Black Hat security conferences throughout the world. Under the alias "PortSwigger", Dafydd developed the popular Burp Suite of web application hack tools.
""This is the best book on SSL/TLS. Rescorla knows SSL/TLS as well as anyone and presents it both clearly and completely.... At times, I felt like he's been looking over my shoulder when I designed SSL v3. If network security matters to you, buy this book."" Paul Kocher, Cryptography Research, Inc. Co-Designer of SSL v3 " "Having the right crypto is necessary but not sufficient to having secure communications. If you're using SSL/TLS, you should have "SSL and TLS"sitting on your shelf right next to "Applied Cryptography." Bruce Schneier, Counterpane Internet Security, Inc. Author of "Applied Cryptography"" "Everything you wanted to know about SSL/TLS in one place. It covers the protocols down to the level of packet traces. It covers how to write software that uses SSL/TLS. And it contrasts SSL with other approaches. All this while being technically sound and readable!"" Radia Perlman, Sun Microsystems, Inc. Author of "Interconnections" Secure Sockets Layer (SSL) and its IETF successor, Transport Layer Security (TLS), are the leading Internet security protocols, providing security for e-commerce, web services, and many other network functions. Using SSL/TLS effectively requires a firm grasp of its role in network communications, its security properties, and its performance characteristics. "SSL and TLS" provides total coverage of the protocols from the bits on the wire up to application programming. This comprehensive book not only describes how SSL/TLS is supposed to behave but also uses the author's free ssldump diagnostic tool to show the protocols in action. The author covers each protocol feature, first explaining how it works and then illustrating it in a live implementation. This unique presentation bridges the difficult gap between specification and implementation that is a common source of confusion and incompatibility. In addition to describing the protocols, "SSL and TLS" delivers the essential details required by security architects, application designers, and software engineers. Use the practical design rules in this book to quickly design fast and secure systems using SSL/TLS. These design rules are illustrated with chapters covering the new IETF standards for HTTP and SMTP over TLS. Written by an experienced SSL implementor, "SSL and TLS" contains detailed information on programming SSL applications. The author discusses the common problems faced by implementors and provides complete sample programs illustrating the solutions in both C and Java. The sample programs use the free OpenSSL and PureTLS toolkits so the reader can immediately run the examples. 0201615983B04062001
Stephen A. Thomas
"Great writing . . . a clear introduction to the most widely deployed security technology in the Internet."-Paul Lambert, former co-chair of IETF IPSEC working group The Secure Sockets Layer (SSL) and Transport Layer Security(TLS) protocols form the foundation for e-commerce security on the World Wide Web, verifying the authenticity of Web sites, encrypting the transfer of sensitive data, and ensuring the integrity of information exchanged. Now-for the first time the details of these critical security protocols are available in a complete, clear, and concise reference. SSL and TLS Essentials provides complete documentation of the SSL and TLS protocols, including advanced and proprietary extensions never before published. The book thoroughly covers the protocols in operation, including the contents of their messages, message formats, and the cryptographic calculations used to construct them. The text also includes an introduction to cryptography and an explanation of X.509 public key certificates. Stephen Thomas, author of IPng and the TCP/IP Protocols, presents this complex material in a clear and reader-friendly manner. The book includes more than 80 figures and illustrations to supplement its text, and it describes SSL in the context of real-world, practical applications. Readers will immediately understand not only the academic principles behind he security protocols, but how those principles apply to their own network security challenges. The book includes: * Full details of Netscape's SSL and the IETF's TLS protocols, with differences between the two clearl highlighted and explained * A concise tutorial in cryptography * Complete coverage of Netscape's International Step-Up and Microsoft's Server Gated Cryptography implementations * A description of X.509 public key certificates * Details on implementing backwards compatibility among previous versions of SSL and TLS * A thorough security checklist with explanations of all known attacks on SSL implementations, along with appropriate countermeasures. The CD-ROM contains convenient electronic versions of the book for: * Windows(r) CE handheld computers * Adobe(r) Acrobat Reader for PCs Visit our Web site at www.wiley.com/compbooks/