- Prime Student members get an extra 10% off this product Here's how (terms and conditions apply)
The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws Paperback – 7 Oct 2011
|New from||Used from|
- Choose from over 13,000 locations across the UK
- Prime members get unlimited deliveries at no additional cost
- Find your preferred location and add it to your address book
- Dispatch to this address when you check out
Special offers and product promotions
Frequently bought together
Customers who bought this item also bought
Enter your mobile number or email address below and we'll send you a link to download the free Kindle App. Then you can start reading Kindle books on your smartphone, tablet, or computer - no Kindle device required.
To get the free app, enter your mobile phone number.
Would you like to tell us about a lower price?
If you are a seller for this product, would you like to suggest updates through seller support?
From the Back Cover
New technologies. New attack techniques. Start hacking.
Web applications are everywhere, and they're insecure. Banks, retailers, and others have deployed millions of applications thatare full of holes, allowing attackers to steal personal data, carryout fraud, and compromise other systems. This book shows you howthey do it.
This fully updated edition contains the very latest attacktechniques and countermeasures, showing you how to break intotoday's complex and highly functional applications. Roll up yoursleeves and dig in.
Discover how cloud architectures and social networking haveadded exploitable attack surfaces to applications
Leverage the latest HTML features to deliver powerful cross-sitescripting attacks
Deliver new injection exploits, including XML external entityand HTTP parameter pollution attacks
Learn how to break encrypted session tokens and other sensitivedata found in cloud services
Discover how technologies like HTML5, REST, CSS and JSON can beexploited to attack applications and compromise users
Learn new techniques for automating attacksand dealing withCAPTCHAs and cross-site request forgery tokens
Steal sensitive data across domains using seemingly harmlessapplication functions and new browser features
Find help and resources at http: //mdsec.net/wahh
Source code for some of the scripts in the book
Links to tools and other resources
A checklist of tasks involved in most attacks
Answers to the questions posed in each chapter
Hundreds of interactive vulnerability labs
About the Author
DAFYDD STUTTARD is an independent security consultant, author, and software developer specializing in penetration testing of web applications and compiled software. Under the alias PortSwigger, Dafydd created the popular Burp Suite of hacking tools. MARCUS PINTO delivers security consultancy and training on web application attack and defense to leading global organizations in the financial, government, telecom, gaming, and retail sectors. The authors cofounded MDSec, a consulting company that provides training in attack and defense-based security.
Customers who viewed this item also viewed
Showing 1-8 of 27 reviews
There was a problem filtering reviews right now. Please try again later.
While reading the book i found it was quite dry because i was not doing the practical excersises available online. As you have to pay for them i wasn't sure if it would be worth it. With hindsight after doing the course i would highly recommend using them. It will make the content a lot more interesting but also teach a key skill which the book doesn't:
The key to most pen testing and vulnerability research is persistence and logical thinking. It is very well to think you know how a certain bug works but it can still be quite a challenge to actually implement it.
I feel very lucky to have been able to attend the live course for hands on help from the authors but you can definitely get all the information and practice you need purely from the book and the website. Its a shame that there isn't a couple of hours of practical time included when you buy the book.
It is very well written and covers all the areas you would expect. A lot of the old school web bugs explained such as SQL injection and less common now because of better programming practices and interfaces. Later chapters in the book such as the methodologies and logic flaw errors are timeless.
The book also provides real world solutions and mitigation's for the attacks described so this is highly recommended for anyone who develops web applications swell as people who carry out penetration testing on them.
While this may not be the best book ever written i think it definitively describes the topic therefore i have given it 5 stars.
Highly recommended and is used on a daily basis. If you work as a web developer or in cyber security then this book is a must.
Would you like to see more reviews about this item?