Kurzbeschreibung
Among the tests you perform on web applications, security testing is perhaps the most important, yet it's often the most neglected. The recipes in the Web Security Testing Cookbook demonstrate how developers and testers can check for the most common web security issues, while conducting unit tests, regression tests, or exploratory tests. Unlike ad hoc security assessments, these recipes are repeatable, concise, and systematic-perfect for integrating into your regular test suite. Recipes cover the basics from observing messages between clients and servers to multi-phase tests that script the login and execution of web application features. By the end of the book, you'll be able to build tests pinpointed at Ajax functions, as well as large multi-step tests for the usual suspects: cross-site scripting and injection attacks. This book helps you: * Obtain, install, and configure useful-and free-security testing tools * Understand how your application communicates with users, so you can better simulate attacks in your tests * Choose from many different methods that simulate common attacks such as SQL injection, cross-site scripting, and manipulating hidden form fields * Make your tests repeatable by using the scripts and examples in the recipes as starting points for automated tests Don't live in dread of the midnight phone call telling you that your site has been hacked. With Web Security Testing Cookbook and the free tools used in the book's examples, you can incorporate security coverage into your test suite, and sleep in peace.
Synopsis
"Web Security Testing Cookbook" gives developers and testers the tools they need to make security testing a regular part of their development lifecycle. You'll find recipes related to manual, exploratory testing as well as recipes for automated security testing that you can make part of your regression cycle. The recipes cover the basics like observing messages between clients and servers, to multi-phase tests that script the login and execution of web application features. This book provides developers the techniques they need to consider security in their unit tests. Testers will find a wealth of techniques for building web security test cases and executing them. "Web Security Testing Cookbook" also leverages free tools, and not only because they save you considerable expense. In security, perhaps more than in any other specialized discipline, the best tools tend to be free.The book offers recipes in four different sections to help you: learn basics concepts to develop tests, and obtain and set up the tools you'll use; automate tools and scripts to test a web application in a systematic way; also learn methods to bypass client side input validation for various purposes, such as SQL injection, cross-site scripting, and manipulating hidden form fields; and, focus on the session by finding identifiers, analyzing how predictable they are, and manipulating them with tools.
This practical book focuses on how to test web applications - not what web security consists of or why developers should test. Leverage the recipes to add significant security coverage to your testing without adding significant time and cost to your effort.