Rating:
Author: Paco Hope
ISBN : B0026OR3FI
New from $17.27
Format: PDF, EPUB
Posts about Download The Book Free Web Security Testing Cookbook [Kindle Edition] for everyone book 4shared, mediafire, hotfile, and mirror link
Among the tests you perform on web applications, security testing is perhaps the most important, yet it's often the most neglected. The recipes in the Web Security Testing Cookbook demonstrate how developers and testers can check for the most common web security issues, while conducting unit tests, regression tests, or exploratory tests. Unlike ad hoc security assessments, these recipes are repeatable, concise, and systematic-perfect for integrating into your regular test suite.
Recipes cover the basics from observing messages between clients and servers to multi-phase tests that script the login and execution of web application features. By the end of the book, you'll be able to build tests pinpointed at Ajax functions, as well as large multi-step tests for the usual suspects: cross-site scripting and injection attacks. This book helps you:
- Obtain, install, and configure useful-and free-security testing tools
- Understand how your application communicates with users, so you can better simulate attacks in your tests
- Choose from many different methods that simulate common attacks such as SQL injection, cross-site scripting, and manipulating hidden form fields
- Make your tests repeatable by using the scripts and examples in the recipes as starting points for automated tests
Don't live in dread of the midnight phone call telling you that your site has been hacked. With Web Security Testing Cookbook and the free tools used in the book's examples, you can incorporate security coverage into your test suite, and sleep in peace.
Download latest books on mediafire and other links compilation Free Web Security Testing Cookbook
- File Size: 2742 KB
- Print Length: 314 pages
- Simultaneous Device Usage: Unlimited
- Publisher: O'Reilly Media; 1 edition (October 13, 2008)
- Sold by: Amazon Digital Services, Inc.
- Language: English
- ASIN: B0026OR3FI
- Text-to-Speech: Enabled
X-Ray:
- Lending: Not Enabled
- Amazon Best Sellers Rank: #441,068 Paid in Kindle Store (See Top 100 Paid in Kindle Store)
Free Web Security Testing Cookbook
This book is about how web applications are tested with an emphasis on security. This book is aimed at web applications developers and testers, not security specialists. Developers who are responsible for writing unit tests for their components will appreciate the way that these tools can be focused on an individual page, feature, or form. Quality assurance professionals who must test whole web applications will be especially interested in the automation and development of test cases that can easily become parts of regression suites. The recipes in this book mainly use free tools, making them easy to try out and hopefully adopt.
The unfortunate problem with free tools in so many cases is lack documentation. This book fills that gap by showing you how to make good use of tools that you might have heard of that don't have good documentation on their application. Another barrier to effectively testing web applications with free tools is a general lack of knowledge about how the tools can be put together to perform good security tests. It's one thing to know that TamperData lets you bypass client-side checks. It's another thing to develop a good cross-site scripting test using TamperData. This book takes you beyond making good web application tests and helps you produce good security test cases.
The book divides material into three sections. The first section covers setting up tools and some of the basics concepts used to develop tests. The second section is about the different methods of bypassing client-side input validation via SQL injection, cross-site scripting, and manipulating hidden form fields. The third section is about the session, locating session identifiers, determining their predictability, and how to manipulate them.
I bought this book on the strength of other reviews, and I'm a bit disappointed. It's useful, but not worthy of 5 stars.
The book is structured like the other "Cookbook" titles from O'Reilly. Each chapter has a series of "recipes" that describe a problem, present a solution, and have some discussion about the issue. It's unclear exactly who the target audience is.
Some of the recipes are very basic -- this is good if you've got very little experience working with tools like curl or wget, but not worth much if you've seen these and know how to read the man pages for these tools to find the flag you're looking for. Recipes like these lead me to believe that the audience for the book includes people who are very new to web technologies.
Other recipes are meaty enough -- there are several recipes that have page-long perl or bash scripts to automate (for example) the hunt for XSS vulnerabilities.
But then again, I can't see how a rookie web tester can possibly get through the book without a lot of head scratching. While vulnerabilities like cross-site scripting (XSS) and SQL injection are mentioned frequently, they are never defined, and their mechanism of operation is never clearly laid out. This leads me to believe that the target audience is people with at least an intermediate-level understanding of what these attacks mean, how they are performed, and what happens behind the scenes.
I was disappointed to see a couple of serious errors after only browsing through the recipes for an hour or so. For example, on page 90 the authors state that on Unix/Linux systems, filenames can contain slashes. This is incorrect: slashes are the only non-NUL character *not* allowed in a Linux filename.
-
Download Link 2