Title: The Web Application Hacker’s Handbook: Detecting and Exploiting Security Flaws
Authors: Dafydd Stuttard & Marcus Pinto
Published: October 2007, Wiley.
ISBN: 0470170778 / 978-0470170779
Before you even read a word, “The Web Application Hacker’s Handbook: Discovering and Exploiting Security Flaws” should catch your interest for two reasons. The first is that, by name and cover art, it is being presented by Wiley as the web security counterpart of “The Shellcoder’s Handbook”, which I have already given a positive review. The second reason, which I did not realize it until the book arrived, is that one of the authors, Dafydd Stuttard, is the author of the excellent Burp Suite tools for exploring and exploiting web applications. I use the proxy features of it frequently, and I often tell people it’s the only reason I install a Java VM on my laptop . I was very excited about reading a web application security by the author of such a great set of tools, and it did not let me down.
I will admit that I haven’t read any other books that focus on attacking web applications, so I do not have anything to compare it to. I can say, however, that this book has very complete and thorough coverage of the topic, from mapping the application to exploitation. While a number of common attacks are covered (such as cross-site scripting and SQL injection), the real value of the book is in the way it teaches the process of finding vulnerabilities. Armed with this, you can more effectively discover problems that involve logical errors unique to the application you’re looking at. The book reads very well cover-to-cover, with each chapter building up another step in a complete web application hacker’s methodology that the authors have put together.
The topics covered encompass most of the vulnerabilities you’ll see disclosed in applications daily on the mailing lists. Rather than having chapters for specific attacks, the authors gather them up into meaningful categories to present related content together. For example, SQL injection and remote-file-inclusion are rolled into a chapter titled “Injecting Code”. Similarly, cross-site scripting attacks, session fixation, and request forgery are covered in “Attacking Other Users”. There is introductory material in an early chapter on “Web Application Technologies”, however I would recommend that anyone picking this book up be at least somewhat familiar with how web applications work, either from the viewpoint of a developer or understanding the basics of attacks. The questions at the end of each chapter are designed to test the reader’s understanding of the chapter’s material, and I found it helpful to at least read over them and give them some thought. Someone just getting started with web security would probably get a lot of value out of focusing on each question.
For such a large book, it is a very pleasant surprise to say that I ran across no obvious errors. The website for the book is very complete, and contains answers for all of the questions at the ends of chapters, the source code for a tool developed in one of the chapters, a list of tools described in the text, and a checklist for the methodology presented in the final chapter. If you have an interest in web application security, I would highly recommend picking up a copy of this book, especially if you’re interested in being able to audit applications for vulnerabilities. Even for a web application developer, however, the book has a lot of merit. It’s important to understand the ways in which your application will be attacked, and mitigation strategies are presented in the book for each attack.
I enjoyed the book, found the techniques presented to be very useful, and I plan on making use of the methodology presented.