Rating:
Author: Tom Gallagher
ISBN : B004LRPB98
New from $22.99
Format: PDF
Free download Free Hunting Security Bugs for everyone book 4shared, mediafire, hotfile, and mirror link
Learn how to think like an attacker—and identify potential security issues in your software. In this essential guide, security testing experts offer practical, hands-on guidance and code samples to help you find, classify, and assess security bugs before your software is released.
Discover how to:
- Identify high-risk entry points and create test cases
- Test clients and servers for malicious request/response bugs
- Use black box and white box approaches to help reveal security vulnerabilities
- Uncover spoofing issues, including identity and user interface spoofing
- Detect bugs that can take advantage of your program’s logic, such as SQL injection
- Test for XML, SOAP, and Web services vulnerabilities
- Recognize information disclosure and weak permissions issues
- Identify where attackers can directly manipulate memory
- Test with alternate data representations to uncover canonicalization issues
- Expose COM and ActiveX repurposing attacks
PLUS—Get code samples and debugging tools on the Web
Direct download links available for Free Hunting Security Bugs
- File Size: 5373 KB
- Print Length: 590 pages
- Simultaneous Device Usage: Unlimited
- Publisher: Microsoft Press; 1 edition (January 20, 2011)
- Sold by: Amazon Digital Services, Inc.
- Language: English
- ASIN: B004LRPB98
- Text-to-Speech: Enabled
X-Ray:
- Lending: Not Enabled
- Amazon Best Sellers Rank: #673,122 Paid in Kindle Store (See Top 100 Paid in Kindle Store)
- #72
in Books > Computers & Technology > Programming > Languages & Tools > Debugging
- #72
in Books > Computers & Technology > Programming > Languages & Tools > Debugging
Free Hunting Security Bugs
As with other reviewers of the book: in an attempt at full disclosure, I also work at Microsoft. I am a Test Lead in the Office organization.
One of the challenges that faces any quality assurance engineer or Test engineer, or whatever our industry has chosen to call us this year is that we are constantly tasked with trying to "test in security" or "find the flaws in the product" after it has already been coded. While this is clearly a PART of our jobs, it is by no means the most important part. This book addresses what I consider to be a much higher priority for the Test Org generally, and Test Engineers specifically: helping reduce security vulnerabilities before they are coded into the product to begin with: as features are being spec'd and as code is being designed.
This book is not a simple check-list testers can use to say "Yes, my feature is secure, Ship It". Rather, it helps place Test into the frame of mind of a hacker, it gives test a set of tools to help find security issues, it outlines an approach to software Test that will cause fewer security issues to be coded at all, let alone have to be fixed post code-complete (or in a Service Pack). Used in conjunction with other test books like _How to Break Software Security_ by James A. Whittaker, this book will help ship more secure products.
Incidentally, I expect hackers will be reading this book in an effort to better understand the science of hunting security bugs, as well as the tools we use to do so - so if you're not using it, I'd expect your attackers will be thankful...
By John Jansen
Beside Bruce Schneier books, this is the second software security book that I am reading. The first being
Building Secure Software: How to Avoid Security Problems the Right Way and I have prefered this one because it provides more concrete examples. The book consists of over 20 chapters covering different security areas. As a software developer, some chapters appeared less relevent and less interesting to me and I guess that it is because these chapters are geared principally toward testers. However, at least 2 chapters should be extremely interesting and valuable to developers like myself. It is the chapters that demonstrate with step by step tutorials how a hacker would do to exploit buffer overflow and format string problems. I was already familiar with buffer overflows and I had read a similar chapter about them in
Building Secure Software: How to Avoid Security Problems the Right Way but the format string exploits were new to me. As expected since the book is published by Microsoft Press, the book has a strong bias torward Microsoft products (ie.: .NET and ActiveX controls security) but the presented topics are general enough to make this book very valuable even for users of other OSes and/or development tools.