Save up to 30% on Elsevier print and eBooks with free shipping. No promo code needed.
Save up to 30% on print and eBooks.
Web Application Obfuscation
'-/WAFs..Evasion..Filters//alert(/Obfuscation/)-'
1st Edition - December 10, 2010
Authors: Mario Heiderich, Eduardo Alberto Vela Nava, Gareth Heyes, David Lindsay
Language: English
Paperback ISBN:9781597496049
9 7 8 - 1 - 5 9 7 4 9 - 6 0 4 - 9
eBook ISBN:9781597496056
9 7 8 - 1 - 5 9 7 4 9 - 6 0 5 - 6
Web applications are used every day by millions of users, which is why they are one of the most popular vectors for attackers. Obfuscation of code has allowed hackers to take on…Read more
Purchase options
LIMITED OFFER
Save 50% on book bundles
Immediately download your ebook while waiting for your print delivery. No promo code is needed.
Web applications are used every day by millions of users, which is why they are one of the most popular vectors for attackers. Obfuscation of code has allowed hackers to take one attack and create hundreds-if not millions-of variants that can evade your security measures. Web Application Obfuscation takes a look at common Web infrastructure and security controls from an attacker's perspective, allowing the reader to understand the shortcomings of their security systems. Find out how an attacker would bypass different types of security controls, how these very security controls introduce new types of vulnerabilities, and how to avoid common pitfalls in order to strengthen your defenses.
Named a 2011 Best Hacking and Pen Testing Book by InfoSec Reviews
Looks at security tools like IDS/IPS that are often the only defense in protecting sensitive data and assets
Evaluates Web application vulnerabilties from the attacker's perspective and explains how these very systems introduce new types of vulnerabilities
Teaches how to secure your data, including info on browser quirks, new attacks and syntax tricks to add to your defenses against XSS, SQL injection, and more
Penetration testers, security consultants; IDS Developers; Security Tool Developers; WAF Implementers and Maintainers; Web Developers; and Sys/Net Admins
Chapter 1: Introduction Chapter 2: HTML Chapter 3: JavaScript and VBScript Chapter 4: Nonalphanumeric JavaScript Chapter 5: CSS Chapter 6: PHP Chapter 7: SQL Chapter 8: Web Application Firewalls and Client-side Filters Chapter 9: Mitigating Bypasses and Attacks Chapter 10: Future Developments
No. of pages: 296
Language: English
Edition: 1
Published: December 10, 2010
Imprint: Syngress
Paperback ISBN: 9781597496049
eBook ISBN: 9781597496056
MH
Mario Heiderich
Mario Heiderich is a Cologne, Germany-based freelancer and entrepreneur who is devoted to Web application development and security and is currently working on several projects while earning his Ph.D. at Ruhr University in Bochum. He graduated from the University of Applied Sciences in Friedberg/Hessen with a degree in media informatics, and has been working for several German and international companies as a developer and security consultant. In addition to being lead developer for the PHPIDS and author of a German book about Web application security, he has been a speaker at several conferences and a trainer for Web security classes around the world. His work is focused on client-side attacks and defense, especially markup, CSS, and JavaScript, on all major user agents.
EV
Eduardo Alberto Vela Nava
Eduardo Alberto Vela Nava (Application Security Specialist) works as an information security researcher at Google, Inc., with the task of improving the security of Google and the Internet as a whole, by researching security problems and creating solutions to them. His primary focus is Web application security and browser/plug-in security. He has been a presenter focusing on Web security at several conferences around the world. He previously worked at Alibaba Cloud Computing and Hi5 Networks.
Affiliations and expertise
Application Security Specialist, Information Security Researcher, Google, Inc.
GH
Gareth Heyes
Gareth Heyes is based in the United Kingdom and does Web security contracting work and the occasional Web development project. He has been a speaker at the Microsoft BlueHat, Confidence Poland, and OWASP conferences, and is the author of many Web-based tools and sandboxes, including Hackvertor, JSReg, CSSReg, and HTMLReg.
DL
David Lindsay
David Lindsay is a senior security consultant with Cigital Inc., where he works with industry-leading financial, healthcare, and software companies helping to secure their critical applications. He provides professional assessments and remediation assistance in the form of penetration tests, architecture risk analysis, code review, and security training. He researches Web application security vulnerabilities focusing on emerging security issues related to new standards, frameworks, and architectures. He has spoken at many leading security events over the past few years, including the Microsoft BlueHat, BlackHat, and OWASP conferences.
David graduated from the University of Utah with a master's degree in mathematics.