Art of Software Security Assessment Identifying and Preventing Software Vulnerabilities

ISBN-10: 0321444426

ISBN-13: 9780321444424

Edition: 2007

Authors: Mark Dowd, John McDonald, Justin Schuh

List price: $79.99 Buy it from $69.64
eBook available
This item qualifies for FREE shipping

*A minimum purchase of $35 is required. Shipping is provided via FedEx SmartPost® and FedEx Express Saver®. Average delivery time is 1 – 5 business days, but is not guaranteed in that timeframe. Also allow 1 - 2 days for processing. Free shipping is eligible only in the continental United States and excludes Hawaii, Alaska and Puerto Rico. FedEx service marks used by permission."Marketplace" orders are not eligible for free or discounted shipping.

30 day, 100% satisfaction guarantee

If an item you ordered from TextbookRush does not meet your expectations due to an error on our part, simply fill out a return request and then return it by mail within 30 days of ordering it for a full refund of item cost.

Learn more about our returns policy

Description:

'The Art of Software Security Assessment' features solid code auditing methodologies and secrets of the trade from two very successful security researchers, Mark Dowd and John McDonald.
New Starting from $69.64
eBooks Starting from $63.99
Buy eBooks
what's this?
Rush Rewards U
Members Receive:
coins
coins
You have reached 400 XP and carrot coins. That is the daily max!
Study Briefs

Limited time offer: Get the first one free! (?)

All the information you need in one place! Each Study Brief is a summary of one specific subject; facts, figures, and explanations to help you learn faster.

Add to cart
Study Briefs
Periodic Table Online content $4.95 $1.99
Add to cart
Study Briefs
Medical Terminology Online content $4.95 $1.99
Add to cart
Study Briefs
SQL Online content $4.95 $1.99
Customers also bought
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading
Loading

Book details

List price: $79.99
Copyright year: 2007
Publisher: Addison Wesley Professional
Publication date: 11/20/2006
Binding: Paperback
Pages: 1200
Size: 7.00" wide x 9.00" long x 2.00" tall
Weight: 4.246

About the Authors
Preface
Acknowledgments
Introduction to Software Security Assessment
Software Vulnerability Fundamentals
Introduction
Vulnerabilities
Security Policies
Security Expectations
The Necessity of Auditing
Auditing Versus Black Box Testing
Code Auditing and the Development Life Cycle
Classifying Vulnerabilities
Design Vulnerabilities
Implementation Vulnerabilities
Operational Vulnerabilities
Gray Areas
Common Threads
Input and Data Flow
Trust Relationships
Assumptions and Misplaced Trust
Interfaces
Environmental Attacks
Exceptional Conditions
Summary
Design Review
Introduction
Software Design Fundamentals
Algorithms
Abstraction and Decomposition
Trust Relationships
Principles of Software Design
Fundamental Design Flaws
Enforcing Security Policy
Authentication
Authorization
Accountability
Confidentiality
Integrity
Availability
Threat Modeling
Information Collection
Application Architecture Modeling
Threat Identification
Documentation of Findings
Prioritizing the Implementation Review
Summary
Operational Review
Introduction
Exposure
Attack Surface
Insecure Defaults
Access Control
Unnecessary Services
Secure Channels
Spoofing and Identification
Network Profiles
Web-Specific Considerations
HTTP Request Methods
Directory Indexing
File Handlers
Authentication
Default Site Installations
Overly Verbose Error Messages
Public-Facing Administrative Interfaces
Protective Measures
Development Measures
Host-Based Measures
Network-Based Measures
Summary
Application Review Process
Introduction
Overview of the Application Review Process
Rationale
Process Outline
Preassessment
Scoping
Application Access
Information Collection
Application Review
Avoid Drowning
Iterative Process
Initial Preparation
Plan
Work
Reflect
Documentation and Analysis
Reporting and Remediation Support
Code Navigation
External Flow Sensitivity
Tracing Direction
Code-Auditing Strategies
Code Comprehension Strategies
Candidate Point Strategies
Design Generalization Strategies
Code-Auditing Techniques
Internal Flow Analysis
Subsystem and Dependency Analysis
Rereading Code
Desk-Checking
Test Cases
Code Auditor's Toolbox
Source Code Navigators
Debuggers
Binary Navigation Tools
Fuzz-Testing Tools
Case Study: OpenSSH
Preassessment
Implementation Analysis
High-Level Attack Vectors
Documentation of Findings
Summary
Software Vulnerabilities
Memory Corruption
Introduction
Buffer Overflows
Process Memory Layout
Stack Overflows
Off-by-One Errors
Heap Overflows
Global and Static Data Overflows
Shellcode
Writing the Code
Finding Your Code in Memory
Protection Mechanisms
Stack Cookies
Heap Implementation Hardening
Nonexecutable Stack and Heap Protection
Address Space Layout Randomization
SafeSEH
Function Pointer Obfuscation
Assessing Memory Corruption Impact
Where Is the Buffer Located in Memory?
What Other Data Is Overwritten?
How Many Bytes Can Be Overwritten?
What Data Can Be Used to Corrupt Memory?
Are Memory Blocks Shared?
What Protections Are in Place?
Summary
C Language Issues
Introduction
C Language Background
Data Storage Overview
Binary Encoding
Byte Order
Common Implementations
Arithmetic Boundary Conditions
Unsigned Integer Boundaries
Signed Integer Boundaries
Type Conversions
Overview
Conversion Rules
Simple Conversions
Integer Promotions
Integer Promotion Applications
Usual Arithmetic Conversions
Usual Arithmetic Conversion Applications
Type Conversion Summary
Type Conversion Vulnerabilities
Signed/Unsigned Conversions
Sign Extension
Truncation
Comparisons
Operators
The sizeof Operator
Unexpected Results
Pointer Arithmetic
Pointer Overview
Pointer Arithmetic Overview
Vulnerabilities
Other C Nuances
Order of Evaluation
Structure Padding
Precedence
Macros/Preprocessor
Typos
Summary
Program Building Blocks
Introduction
Auditing Variable Use
Variable Relationships
Structure and Object Mismanagement
Variable Initialization
Arithmetic Boundaries
Type Confusion
Lists and Tables
Auditing Control Flow
Looping Constructs
Flow Transfer Statements
Switch Statements
Auditing Functions
Function Audit Logs
Return Value Testing and Interpretation
Function Side-Effects
Argument Meaning
Auditing Memory Management
ACC Logs
Allocation Functions
Allocator Scorecards and Error Domains
Double-Frees
Summary
Strings and Metacharacters
Introduction
C String Handling
Unbounded String Functions
Bounded String Functions
Common Issues
Metacharacters
Embedded Delimiters
NUL Character Injection
Truncation
Common Metacharacter Formats
Path Metacharacters
C Format Strings
Shell Metacharacters
Perl open()
SQL Queries
Metacharacter Filtering
Eliminating Metacharacters
Escaping Metacharacters
Metacharacter Evasion
Character Sets and Unicode
Unicode
Windows Unicode Functions
Summary
UNIX I: Privileges and Files
Introduction
UNIX 101
Users and Groups
Files and Directories
Processes
Privilege Model
Privileged Programs
User ID Functions
Group ID Functions
Privilege Vulnerabilities
Reckless Use of Privileges
Dropping Privileges Permanently
Dropping Privileges Temporarily
Auditing Privilege-Management Code
Privilege Extensions
File Security
File IDs
File Permissions
Directory Permissions
Privilege Management with File Operations
File Creation
Directory Safety
Filenames and Paths
Dangerous Places
Interesting Files
File Internals
File Descriptors
Inodes
Directories
Links
Symbolic Links
Hard Links
Race Conditions
TOCTOU
The stat() Family of Functions
File Race Redux
Permission Races
Ownership Races
Directory Races
Temporary Files
Unique File Creation
File Reuse
Temporary Directory Cleaners
The Stdio File Interface
Opening a File
Reading from a File
Writing to a File
Closing a File
Summary
UNIX II: Processes
Introduction
Processes
Process Creation
fork() Variants
Process Termination
fork() and Open Files
Program Invocation
Direct Invocation
Indirect Invocation
Process Attributes
Process Attribute Retention
Resource Limits
File Descriptors
Environment Arrays
Process Groups, Sessions, and Terminals
Interprocess Communication
Pipes
Named Pipes
System V IPC
UNIX Domain Sockets
Remote Procedure Calls
RPC Definition Files
RPC Decoding Routines
Authentication
Summary
Windows I: Objects and the File System
Introduction
Background
Objects
Object Namespaces
Object Handles
Sessions
Security IDs
Logon Rights
Access Tokens
Security Descriptors
Access Masks
ACL Inheritance
Security Descriptors Programming Interfaces
Auditing ACL Permissions
Processes and Threads
Process Loading
ShellExecute and ShellExecuteEx
DLL Loading
Services
File Access
File Permissions
The File I/O API
Links
The Registry
Key Permissions
Key and Value Squatting
Summary
Windows II: Interprocess Communication
Introduction
Windows IPC Security
The Redirector
Impersonation
Window Messaging
Window Stations Object
The Desktop Object
Window Messages
Shatter Attacks
DDE
Terminal Sessions
Pipes
Pipe Permissions
Named Pipes
Pipe Creation
Impersonation in Pipes
Pipe Squatting
Mailslots
Mailslot Permissions
Mailslot Squatting
Remote Procedure Calls
RPC Connections
RPC Transports
Microsoft Interface Definition Language
IDL File Structure
Application Configuration Files
RPC Servers
Impersonation in RPC
Context Handles and State
Threading in RPC
Auditing RPC Applications
COM
COM: A Quick Primer
DCOM Configuration Utility
DCOM Application Identity
DCOM Subsystem Access Permissions
DCOM Access Controls
Impersonation in DCOM
MIDL Revisited
Active Template Library
Auditing DCOM Applications
ActiveX Security
Summary
Synchronization and State
Introduction
Synchronization Problems
Reentrancy and Asynchronous-Safe Code
Race Conditions
Starvation and Deadlocks
Process Synchronization
System V Process Synchronization
Windows Process Synchronization
Vulnerabilities with Interprocess Synchronization
Signals
Sending Signals
Handling Signals
Jump Locations
Signal Vulnerabilities
Signals Scoreboard
Threads
PThreads API
Windows API
Threading Vulnerabilities
Summary
Software Vulnerabilities in Practice
Network Protocols
Introduction
Internet Protocol
IP Addressing Primer
IP Packet Structures
Basic IP Header Validation
IP Options Processing
Source Routing
Fragmentation
User Datagram Protocol
Basic UDP Header Validation
UDP Issues
Transmission Control Protocol
Basic TCP Header Validation
TCP Options Processing
TCP Connections
TCP Streams
TCP Processing
Summary
Firewalls
Introduction
Overview of Firewalls
Proxy Versus Packet Filters
Attack Surface
Proxy Firewalls
Packet-Filtering Firewalls
Stateless Firewalls
TCP
UDP
FTP
Fragmentation
Simple Stateful Firewalls
TCP
UDP
Directionality
Fragmentation
Stateful Inspection Firewalls
Layering Issues
Spoofing Attacks
Spoofing from a Distance
Spoofing Up Close
Spooky Action at a Distance
Summary
Network Application Protocols
Introduction
Auditing Application Protocols
Collect Documentation
Identify Elements of Unknown Protocols
Match Data Types with the Protocol
Data Verification
Access to System Resources
Hypertext Transfer Protocol
Header Parsing
Accessing Resources
Utility Functions
Posting Data
Internet Security Association and Key Management Protocol
Payloads
Payload Types
Encryption Vulnerabilities
Abstract Syntax Notation (ASN.1)
Basic Encoding Rules
Canonical Encoding and Distinguished Encoding
Vulnerabilities in BER, CER; and DER Implementations
Packed Encoding Rules (PER)
XML Encoding Rules
XER Vulnerabilities
Domain Name System
Domain Names and Resource Records
Name Servers and Resolvers
Zones
Resource Record Conventions
Basic Use Case
DNS Protocol Structure Primer
DNS Names
Length Variables
DNS Spoofing
Summary
Web Applications
Introduction
Web Technology Overview
The Basics
Static Content
CGI
Web Server APIs
Server-Side Includes
Server-Side Transformation
Server-Side Scripting
HTTP
Overview
Versions
Headers
Methods
Parameters and Forms
State and HTTP Authentication
Overview
Client IP Addresses
Referer Request Header
Embedding State in HTML and URLs
HTTP Authentication
Cookies
Sessions
Architecture
Redundancy
Presentation Logic
Business Logic
N-Tier Architectures
Business Tier
Web Tier: Model-View-Controller
Problem Areas
Client Visibility
Client Control
Page Flow
Sessions
Authentication
Authorization and Access Control
Encryption and SSL/TLS
Phishing and Impersonation
Common Vulnerabilities
SQL Injection
OS and File System Interaction
XML Injection
XPath Injection
Cross-Site Scripting
Threading Issues
C/C++ Problems
Harsh Realities of the Web
Auditing Strategy
Summary
Web Technologies
Introduction
Web Services and Service-Oriented Architecture
SOAP
REST
AJAX
Web Application Platforms
CGI
Indexed Queries
Environment Variables
Path Confusion
Perl
SQL Injection
File Access
Shell Invocation
File Inclusion
Inline Evaluation
Cross-Site Scripting
Taint Mode
PHP
SQL Injection
File Access
Shell Invocation
File Inclusion
Inline Evaluation
Cross-Site Scripting
Configuration
Java
SQL Injection
File Access
Shell Invocation
File Inclusion
JSP File Inclusion
Inline Evaluation
Cross-Site Scripting
Threading Issues
Configuration
ASP
SQL Injection
File Access
Shell Invocation
File Inclusion
Inline Evaluation
Cross-Site Scripting
Configuration
ASP.NET
SQL Injection
File Access
Shell Invocation
File Inclusion
Inline Evaluation
Cross-Site Scripting
Configuration
ViewState
Summary
Bibliography
Index
Free shipping on orders over $35*

*A minimum purchase of $35 is required. Shipping is provided via FedEx SmartPost® and FedEx Express Saver®. Average delivery time is 1 – 5 business days, but is not guaranteed in that timeframe. Also allow 1 - 2 days for processing. Free shipping is eligible only in the continental United States and excludes Hawaii, Alaska and Puerto Rico. FedEx service marks used by permission."Marketplace" orders are not eligible for free or discounted shipping.

Learn more about the TextbookRush Marketplace.

×