A while ago I was offered an excellent opportunity to read and review Mike Shema’s contribution to Syngress’s Seven Deadliest series focused on web application security. My first impression was very positive, and now I’ve had a chance to get my hands on the finished product I haven’t been disappointed.
As with the rest of the Seven Deadliest series the book is broken down into sever chapters, each focusing on a key attack vector. Covered in Web Application Attacks is:
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- SQL Injection
- Server Misconfiguration and Predictable Pages
- Breaking Authentication Schemes
- Logic Attacks
- Malware and Browser Attacks
I’ll be the first to admit that web application security isn’t my forte. Rather than let that put me off this was the appeal of the Seven Deadliest series, given the target topic the books aim is to succinctly cover the core issues and let the reader quickly get to grips with the subject material. Shema does this brilliantly; before I reading the book I (thought I) was comfortable with my understanding of web application security issues, after reading I’m now confident in both my theoretical understanding and, crucially, the technical implementation of the attack vectors discussed.
While the material is accessible to a new comer to web application security Shema wasn’t able to cover all subjects touched on during the book. For example, character encoding sets are discussed quite heavily during the cross-site scripting, but isn’t explained indepth at a low level. As a result, what a reader is able to take away from the book will likely be dependent on the experience and knowledge that the reader is able to bring to the material. In my case I was more comfortable with the chapters covering server misconfiguration (chapter 4) and malware (chapter 7).
After re-reading the material I would recommend this book to anyone that deals with web sites in anyway (that’s you), especially considering the price of the Severn Deadliest books. I’d also take a look at the rest of the series, covering:
- Seven Deadliest Microsoft Attacks
- Seven Deadliest Network Attacks
- Seven Deadliest USB attacks
- Seven Deadliest Unified Communications
- Seven Deadliest Wireless Technologies
- Seven Deadliest Social Network Attacks
- Seven Deadliest Web Application Attacks
— Andrew Waite
(oh, and if you won’t take my word for it, pay attention to the recommendation on the back….)
“The threats highlighted should be understood by Web developers, administrators, and general users alike. If you use the Web in any way then this should be on your bookshelf. In addition to detailing the threat Shema also provides countermeasures to minimize or remove the risk, but be warned; you may never look at a Web site in the same way again.”
Andrew Waite, Security Researcher, InfoSanity Research
The snippet of your review made it on to the back of the book?? Awesome! Congrats!
Other way around, I was asked to read through a pre-print version and share my thoughts. Really liked the book (as you can tell), I think the fact I took so much from it without being a web app specialist really shows the benefit of the way the material is presented. 7 crucial aspects of a single topic, one handy resource, definitely intend to add some of the others in the series to my bookshelf in the future.
pergh… i wonder when I’ll get people to ask me to review theirs :p