|
The Software Vullerability Guide
n today's market, secure software is a must for consumers. Many developers, however, are not familiar with the techniques needed to produce secure code or detect existing vulnerabilities. The Software Vulnerability Guide focuses on the origin of most software vulnerabilities, including the bugs in the underlying software used to develop IT infrastructures
and the Internet. Most of these security bugs (and the viruses, worms, and exploits that derive from them) started out as programmer mistakes. With this easy-to-use guide, professional programmers and testers will learn how to recognize and prevent these vulnerabilities before their software reaches the market. For each of the 30 common software vulnerabilities featured the authors provide a summary, description of how the vulnerability occurs, and famous examples of how it has been used. Tips on how to find and fix the vulnerability in software are also provided along with source code snippets, commentary, tools, and techniques in easy-to-read sidebars. This guide is a musthave for today's software developers.
Introduction; Section 1: Misconfigurations; Chapter 1-Accepting Arbitrary Files As Parameters; Chapter 2-Permitting Relative and Default Paths; Chapter 3-Offering Administrative, Software and Service Back Doors; Chapter 4-Permitting Default or Weak Passwords; Chapter 5-Shells, Scripts, and Programmatic Access; Chapter 6-Dynamic Linking and Loading; Section 2: Data Parsing; Chapter 7-Buffer Overflows; Chapter 8-Format String Attacks; Chapter 9-Type and Context API Attacks; Section 3: Visibility; Chapter 10-Storing Passwords in Plain Text; Chapter 11-Creating Temporary Files; Chapter 12-Leaving Things in Memory; Chapter 13-The Swap File and Incomplete Deletes; Chapter 14-Using a Universal (or Weekly-Seeded) Key; Chapter 15-Trusting the Operating System APIs; Section 4: On the Wire; Chapter 16-Trusting the Identity of a Remote Host (Spoofing); Chapter 17-Exchanging Sensitive Data in Plain Text; Chapter 18- Volunteering Too Much Information; Chapter 19-Loops, Self References, and Race Conditions; Section 5: Web Sites; Chapter 20-Cross Site Scripting; Chapter 21-Forceful Browsing; Chapter 22-Parameter Tampering; Chapter 23-Cookie Poisoning; Chapter 24-Hidden Field Manipulation; Chapter 25-SQL Injection; Chapter 26-Security on the Client; Chapter 27-Trusting the Domain Security Model; Chapter 28- Trusting SSL; Chapter 30-Conclusion; Appendix A-Reference on Tools; Appendix B-About the CD-ROM; Glossary; Index
|
