Hack Proofing Your Web Applications


Product Description
From the authors of the bestselling Hack Proofing Your Network!OPEC, Amazon, Yahoo! and E-bay: If these large, well-established and security-conscious web sites have problems, how can anyone be safe? How can any programmer expect to develop web applications that are secure?
Hack Proofing Your Web Applications is the only book specifically written for application developers and webmasters who write programs that are used on web sites. It covers Java applications, XML, ColdFusion, and other database applications. Most hacking books focus on catching the hackers once they've entered the site; this one shows programmers how to design tight code that will deter hackers from the word go.
Comes with up-to-the-minute web based support and a CD-ROM containing source codes and sample testing programs
Unique approach: Unlike most hacking books this one is written for the application developer to help them build less vulnerable programs
Hack Proofing Your Web Applications Review
I'm working on a presentation on Web Application Security, and Ipicked up this text as a reference. What a mistake! The text is
vague, poorly formatted and rife with errors.Just one example:
p. 131 shows a sample CGI script for submitting comments to
FreeBSD.org. First of all, the screenshot references a page that
doesn't exist, tarnishing FreeBSD for no good reason. Secondly, the
Perl CGI script doesn't set PATH, doesn't use taint, and doesn't check
exit values. Third, the form uses a hidden field for the submit
address -- making it a juicy spam tool since the user could simply
replace "mcross@freebsd.org" with any address she chooses. And I
could go on and on with just that one script.Other
gripes:
p. 465, "SSL makes the man-in-the-middle attack fail".
Wrong. ...How about this: The authors refer to Perl as the
"Practical Extraction and Reporting Language." (p. 151, p. 223) Are
they trying to impress newbies? SSL & PKI: only 20 pages of 565
are devoted to SSL & PKI, and those are mostly screen shots of Windows
MMC. I'm not picking nits here, just citing examples that
particularly irk me while flipping through it. The author seems to
have little to say about Securing Web Applications, so he rambles on
with useless background and repeats himself often. This might be
useful had it been edited down to 100 pages.I recommend Garfinkel
and Spafford's 'Web Security, Privacy & Commerce,' however Forristal
does minimally discuss ASP, which Garfinkel and Spafford neglect.
Also, Forristal has some interesting ideas for code review.
... Help other customers find the most helpful reviews� Was this review helpful to you?�Yes No Report abuse | PermalinkComment Comment
Most of the consumer Reviews tell that the "Hack Proofing Your Web Applications" are high quality item. You can read each testimony from consumers to find out cons and pros from Hack Proofing Your Web Applications ...
