Web Security for Developers

Table of contents

1. Cover Page
2. Title Page
3. Copyright Page
4. About the Authors
5. BRIEF CONTENTS
6. CONTENTS IN DETAIL
7. ACKNOWLEDGMENTS
8. INTRODUCTION
   1. About This Book
   2. Who Should Read This Book
   3. A Brief History of the Internet
   4. What’s in This Book
9. 1 LET’S HACK A WEBSITE
   1. Software Exploits and the Dark Web
   2. How to Hack a Website
10. Part I: The Basics
11. 2 HOW THE INTERNET WORKS
    1. The Internet Protocol Suite
    2. Application Layer Protocols
    3. Stateful Connections
    4. Encryption
    5. Summary
12. 3 HOW BROWSERS WORK
    1. Web Page Rendering
    2. JavaScript
    3. Before and After Rendering: Everything Else the Browser Does
    4. Summary
13. 4 HOW WEB SERVERS WORK
    1. Static and Dynamic Resources
    2. Static Resources
    3. Dynamic Resources
    4. Summary
14. 5 HOW PROGRAMMERS WORK
    1. Phase 1: Design and Analysis
    2. Phase 2: Writing Code
    3. Phase 3: Pre-Release Testing
    4. Phase 4: The Release Process
    5. Phase 5: Post-Release Testing and Observation
    6. Dependency Management
    7. Summary
15. Part II: The Threats
16. 6 INJECTION ATTACKS
    1. SQL Injection
    2. Command Injection
    3. Remote Code Execution
    4. File Upload Vulnerabilities
    5. Summary
17. 7 CROSS-SITE SCRIPTING ATTACKS
    1. Stored Cross-Site Scripting Attacks
    2. Reflected Cross-Site Scripting Attacks
    3. DOM-Based Cross-Site Scripting Attacks
    4. Summary
18. 8 CROSS-SITE REQUEST FORGERY ATTACKS
    1. Anatomy of a CSRF Attack
    2. Mitigation 1: Follow REST Principles
    3. Mitigation 2: Implement Anti-CSRF Cookies
    4. Mitigation 3: Use the SameSite Cookie Attribute
    5. Bonus Mitigation: Require Reauthentication for Sensitive Actions
    6. Summary
19. 9 COMPROMISING AUTHENTICATION
    1. Implementing Authentication
    2. Mitigation 1: Use Third-Party Authentication
    3. Mitigation 2: Integrate with Single Sign-On
    4. Mitigation 3: Secure Your Own Authentication System
    5. Summary
20. 10 SESSION HIJACKING
    1. How Sessions Work
    2. How Attackers Hijack Sessions
    3. Summary
21. 11 PERMISSIONS
    1. Privilege Escalation
    2. Access Control
    3. Directory Traversal
    4. Summary
22. 12 INFORMATION LEAKS
    1. Mitigation 1: Disable Telltale Server Headers
    2. Mitigation 2: Use Clean URLs
    3. Mitigation 3: Use Generic Cookie Parameters
    4. Mitigation 4: Disable Client-Side Error Reporting
    5. Mitigation 5: Minify or Obfuscate Your JavaScript Files
    6. Mitigation 6: Sanitize Your Client-Side Files
    7. Stay on Top of Security Advisories
    8. Summary
23. 13 ENCRYPTION
    1. Encryption in the Internet Protocol
    2. Enabling HTTPS
    3. Attacking HTTP (and HTTPS)
    4. Summary
24. 14 THIRD-PARTY CODE
    1. Securing Dependencies
    2. Securing Configuration
    3. Securing the Services That You Use
    4. Services as an Attack Vector
    5. Summary
25. 15 XML ATTACKS
    1. The Uses of XML
    2. Validating XML
    3. XML Bombs
    4. XML External Entity Attacks
    5. Securing Your XML Parser
    6. Other Considerations
    7. Summary
26. 16 DON’T BE AN ACCESSORY
    1. Email Fraud
    2. Disguising Malicious Links in Email
    3. Clickjacking
    4. Server-Side Request Forgery
    5. Botnets
    6. Summary
27. 17 DENIAL-OF-SERVICE ATTACKS
    1. Denial-of-Service Attack Types
    2. Denial-of-Service Attack Mitigation
    3. Summary
28. 18 SUMMING UP
29. INDEX