Hacking Exposed (TM) Web Applications

Joel Scambray, CISSP, is Managing Principal with Citigal as well as Co-Founder of Consciere LLC. He was previously chief strategy officer for Leviathan Security Group. He has assisted companies ranging from newly minted startups to members of the Fortune 50 in addressing information security challenges and opportunities for over a dozen years. Joel's background includes roles as an executive, technical consultant, and entrepreneur. He was a senior director at Microsoft Corporation, where he led Microsoft's online services security efforts for three years before joining the Windows platform and services division to focus on security technology architecture. Joel also co-founded security software and services startup Foundstone, Inc. He has also held positions as a Manager for Ernst & Young, Chief Strategy Officer for Leviathan, security columnist for Microsoft TechNet, Editor at Large for InfoWorld Magazine, and director of IT for a major commercial real estate firm. Joel has spoken widely on information security at forums including Black Hat, I-4, and The Asia Europe Meeting (ASEM), as well as organizations including CERT, CSI, ISSA, ISACA, SANS, private corporations, and government agencies such as the Korean Information Security Agency (KISA), FBI, and the RCMP. Joel Scambray is the co-author of all 6 editions of Hacking Exposed. He is also the lead author of Hacking Exposed Windows and Hacking Exposed Web Applications. Mike Shema is the CSO of NT Objectives and has made web application security presentations at numerous security conferences. He has conducted security reviews for a wide variety of web technologies and developed training material for application security courses. He is also a co-author of Anti-Hacker Toolkit.

Part I: Reconnaissance 1: Introduction to Web Applications and Security 2: Profiling 3: Hacking Web Servers 4: Surveying the Application Part II: The Attack 5: Authentication 6: Authorization 7: Attacking Session State Management 8: Input Validation Attacks 9: Attacking Web Datastores 10: Attacking Web Services 11: Hacking Web Application Management 12: Web Client Hacking 13: Case Studies Part III: Appendixes A: Web Site Security Checklist B: Web Hacking Tools and Techniques Cribsheet C: Using Libwhisker D: UrlScan Installation and Configuration E: About the Companion Web Site