Web Security for Developers

Brief Contents
Contents in Detail
Acknowledgments
Introduction
	About This Book
	Who Should Read This Book
	A Brief History of the Internet
		Scripting in the Browser
		A New Challenger Enters the Arena
		Machines for Writing HTML
		A Series of Tubes
		What to Worry About First
	What’s in This Book
Chapter 1: Let’s Hack a Website
	Software Exploits and the Dark Web
	How to Hack a Website
Part 1: The Basics
	Chapter 2: How the Internet Works
		The Internet Protocol Suite
			Internet Protocol Addresses
			The Domain Name System
		Application Layer Protocols
			HyperText Transfer Protocol
		Stateful Connections
		Encryption
		Summary
	Chapter 3: How Browsers Work
		Web Page Rendering
			The Rendering Pipeline: An Overview
			The Document Object Model
			Styling Information
		JavaScript
		Before and After Rendering: Everything Else the Browser Does
		Summary
	Chapter 4: How Web Servers Work
		Static and Dynamic Resources
		Static Resources
			URL Resolution
			Content Delivery Networks
			Content Management Systems
		Dynamic Resources
			Templates
			Databases
			Distributed Caches
			Web Programming Languages
		Summary
	Chapter 5: How Programmers Work
		Phase 1: Design and Analysis
		Phase 2: Writing Code
			Distributed vs. Centralized Version Control
			Branching and Merging Code
		Phase 3: Pre-Release Testing
			Coverage and Continuous Integration
			Test Environments
		Phase 4: The Release Process
			Options for Standardized Deployment During Releases
			The Build Process
			Database Migration Scripts
		Phase 5: Post-Release Testing and Observation
			Penetration Testing
			Monitoring, Logging, and Error Reporting
		Dependency Management
		Summary
Part 2: The Threats
	Chapter 6: Injection Attacks
		SQL Injection
			What Is SQL?
			Anatomy of a SQL Injection Attack
			Mitigation 1: Use Parameterized Statements
			Mitigation 2: Use Object-Relational Mapping
			Bonus Mitigation: Use Defense in Depth
		Command Injection
			Anatomy of a Command Injection Attack
			Mitigation: Escape Control Characters
		Remote Code Execution
			Anatomy of a Remote Code Execution Attack
			Mitigation: Disable Code Execution During Deserialization
		File Upload Vulnerabilities
			Anatomy of a File Upload Attack
			Mitigations
		Summary
	Chapter 7: Cross-Site Scripting Attacks
		Stored Cross-Site Scripting Attacks
			Mitigation 1: Escape HTML Characters
			Mitigation 2: Implement a Content Security Policy
		Reflected Cross-Site Scripting Attacks
			Mitigation: Escape Dynamic Content from HTTP Requests
		DOM-Based Cross-Site Scripting Attacks
			Mitigation: Escaping Dynamic Content from URI Fragments
		Summary
	Chapter 8: Cross-Site Request Forgery Attacks
		Anatomy of a CSRF Attack
		Mitigation 1: Follow REST Principles
		Mitigation 2: Implement Anti-CSRF Cookies
		Mitigation 3: Use the SameSite Cookie Attribute
		Bonus Mitigation: Require Reauthentication for Sensitive Actions
		Summary
	Chapter 9: Compromising Authentication
		Implementing Authentication
			HTTP-Native Authentication
			Non-Native Authentication
			Brute-Force Attacks
		Mitigation 1: Use Third-Party Authentication
		Mitigation 2: Integrate with Single Sign-On
		Mitigation 3: Secure Your Own Authentication System
			Requiring Usernames, Email Address, or Both
			Requiring Complex Passwords
			Securely Storing Passwords
			Requiring Multifactor Authentication
			Implementing and Securing the Logout Function
			Preventing User Enumeration
		Summary
	Chapter 10: Session Hijacking
		How Sessions Work
			Server-Side Sessions
			Client-Side Sessions
		How Attackers Hijack Sessions
			Cookie Theft
			Session Fixation
			Taking Advantage of Weak Session IDs
		Summary
	Chapter 11: Permissions
		Privilege Escalation
		Access Control
			Designing an Authorization Model
			Implementing Access Control
			Testing Access Control
			Adding Audit Trails
			Avoiding Common Oversights
		Directory Traversal
			Filepaths and Relative Filepaths
			Anatomy of a Directory Traversal Attack
			Mitigation 1: Trust Your Web Server
			Mitigation 2: Use a Hosting Service
			Mitigation 3: Use Indirect File References
			Mitigation 4: Sanitize File References
		Summary
	Chapter 12: Information Leaks
		Mitigation 1: Disable Telltale Server Headers
		Mitigation 2: Use Clean URLs
		Mitigation 3: Use Generic Cookie Parameters
		Mitigation 4: Disable Client-Side Error Reporting
		Mitigation 5: Minify or Obfuscate Your JavaScript Files
		Mitigation 6: Sanitize Your Client-Side Files
		Stay on Top of Security Advisories
		Summary
	Chapter 13: Encryption
		Encryption in the Internet Protocol
			Encryption Algorithms, Hashing, and Message Authentication Codes
			The TLS Handshake
		Enabling HTTPS
			Digital Certificates
			Obtaining a Digital Certificate
			Installing a Digital Certificate
		Attacking HTTP (and HTTPS)
			Wireless Routers
			Wi-Fi Hotspots
			Internet Service Providers
			Government Agencies
		Summary
	Chapter 14: Third-Party Code
		Securing Dependencies
			Know What Code You Are Running
			Be Able to Deploy New Versions Quickly
			Stay Alert to Security Issues
			Know When to Upgrade
		Securing Configuration
			Disable Default Credentials
			Disable Open Directory Listings
			Protect Your Configuration Information
			Harden Test Environments
			Secure Administrative Frontends
		Securing the Services That You Use
			Protect Your API Keys
			Secure Your Webhooks
			Secure Content Served by Third Parties
		Services as an Attack Vector
			Be Wary of Malvertising
			Avoid Malware Delivery
			Use a Reputable Ad Platform
			Use SafeFrame
			Tailor Your Ad Preferences
			Review and Report Suspicious Ads
		Summary
	Chapter 15: XML Attacks
		The Uses of XML
		Validating XML
			Document Type Definitions
		XML Bombs
		XML External Entity Attacks
			How Hackers Exploit External Entities
		Securing Your XML Parser
			Python
			Ruby
			Node.js
			Java
			.NET
		Other Considerations
		Summary
	Chapter 16: Don’t Be an Accessory
		Email Fraud
			Implement a Sender Policy Framework
			Implement DomainKeys Identified Mail
			Securing Your Email: Practical Steps
		Disguising Malicious Links in Email
			Open Redirects
			Preventing Open Redirects
			Other Considerations
		Clickjacking
			Preventing Clickjacking
		Server-Side Request Forgery
			Protecting Against Server-Side Forgery
		Botnets
			Protecting Against Malware Infection
		Summary
	Chapter 17: Denial-of-Service Attacks
		Denial-of-Service Attack Types
			Internet Control Message Protocol Attacks
			Transmission Control Protocol Attacks
			Application Layer Attacks
			Reflected and Amplified Attacks
			Distributed Denial-of-Service Attacks
			Unintentional Denial-of-Service Attacks
		Denial-of-Service Attack Mitigation
			Firewalls and Intrusion Prevention Systems
			Distributed Denial-of-Service Protection Services
			Building for Scale
		Summary
	Chapter 18: Summing Up
Index