Hacking web apps: detecting and preventing web application security problems

Hacking Web Apps......Page 0
Hacking Web Apps......Page 3
Copyright\r......Page 5
About the Author......Page 6
Acknowledgements......Page 7
Introduction......Page 8
BOOK AUDIENCE......Page 9
HOW THIS BOOK IS ORGANIZED......Page 13
WHERE TO GO FROM HERE......Page 14
1 HTML5......Page 16
The New Document Object Model (DOM)......Page 17
Cross-Origin Resource Sharing (CORS)......Page 18
WebSockets......Page 21
Transferring Data......Page 25
Data Frames......Page 26
Security Considerations......Page 28
Web Storage......Page 29
Web Workers......Page 31
History API......Page 34
Summary......Page 35
HTML Injection & Cross-Site Scripting (XSS)......Page 37
Understanding HTML Injection......Page 38
Identifying Points of Injection......Page 44
Form Fields......Page 45
HTTP Request Headers & Cookies......Page 47
JavaScript Object Notation (JSON)......Page 48
Document Object Model (DOM) Properties......Page 49
Cascading Style Sheets (CSS)......Page 50
Ephemeral......Page 51
Out of Band......Page 52
Element Attributes......Page 56
JavaScript Variables......Page 58
Putting the Hack Together......Page 59
Abusing Character Sets......Page 62
Encoding 0X00—Nothing Really Matters......Page 64
Why Encoding Matters for HTML Injection......Page 68
Exploiting Failure Modes......Page 70
Bypassing Weak Exclusion Lists......Page 73
Leveraging Browser Quirks......Page 74
The Unusual Suspects......Page 77
Surprising MIME Types......Page 78
SVG Markup......Page 79
Data Redirection......Page 80
Employing Countermeasures......Page 81
Fixing a Static Character Set......Page 82
Normalizing Character Sets and Encoding......Page 83
Encoding the Output......Page 84
Beware of Exclusion Lists and Regexes......Page 85
JavaScript Sandboxes......Page 87
HTML5