现代Web应用安全指南：解密错综复杂的网络世界

5星 · 超过95%的资源需积分: 9 115 浏览量更新于2024-07-25 1 收藏 3.6MB PDF 举报

"The Tangled Web: A Guide to Securing Modern Web Applications" 本书是Web安全领域的一本实战手册，获得了亚马逊的全五星评分，被业界专家高度赞誉。作者深入探讨了现代Web应用程序的安全问题，提供了全面且深刻的见解。这本书是那些重视在线安全与隐私的读者的必读之作。书中涵盖了浏览器安全的各个方面，包括但不限于以下关键知识点： 1. **Web应用的攻击面**：书中详细介绍了Web应用的各种攻击手段，如跨站脚本（XSS）、跨站请求伪造（CSRF）、SQL注入、文件包含漏洞等，并分析了它们的工作原理和防范策略。 2. **浏览器安全机制**：讨论了浏览器如何保护用户免受恶意代码攻击，如同源策略、沙箱模型、内容安全策略（CSP）等，并解释了这些机制的局限性。 3. **JavaScript安全**：JavaScript作为Web开发的核心语言，其安全问题不容忽视。书中可能涵盖DOM遍历漏洞、JSON安全、闭包安全以及如何避免JavaScript注入。 4. **Web组件安全**：讨论了框架、库和插件可能带来的安全风险，如零日漏洞、不安全的依赖管理，以及如何选择和使用安全的第三方组件。 5. **移动Web安全**：随着移动设备的普及，移动Web应用的安全问题也日益突出。书中有对移动平台特有的安全挑战的分析，如应用签名、权限管理等。 6. **隐私保护**：探讨了Cookie管理、跟踪技术、第三方cookies的威胁以及如何保护用户的隐私数据。 7. **Web应用防火墙与入侵检测**：介绍了如何利用WAF和IDS来防御Web攻击，以及它们的配置和优化技巧。 8. **安全编码实践**：提供了一些最佳的安全编码实践，帮助开发者编写更安全的代码，防止常见漏洞的出现。 9. **漏洞评估与测试**：讲解了如何进行安全测试，包括黑盒测试、白盒测试和灰盒测试，以及如何构建有效的渗透测试策略。 10. **应急响应和漏洞披露**：讨论了在发现安全漏洞后的处理流程，包括通知、补丁管理和公开披露的道德和法律问题。《The Tangled Web》是一本深入浅出的Web安全指南，它不仅适合安全专业人员，也适合任何想要了解Web应用程序安全的开发者或普通用户。通过阅读本书，读者将能够更好地理解Web安全的复杂性，提升自身的防护能力，确保在日益复杂的网络环境中保护自己的安全和隐私。

xiv Contents in Detail

Cross-Domain Content Inclusion .............................................................................. 181

A Note on Cross-Origin Subresources......................................................... 183

Privacy-Related Side Channels ................................................................................ 184

Other SOP Loopholes and Their Uses ...................................................................... 185

Security Engineering Cheat Sheet............................................................................ 186

Good Security Hygiene for All Websites ..................................................... 186

When Including Cross-Domain Resources .................................................... 186

When Arranging Cross-Domain Communications in JavaScript ...................... 186

OTHER SECURITY BOUNDARIES 187

Navigation to Sensitive Schemes............................................................................. 188

Access to Internal Networks.................................................................................... 189

Prohibited Ports..................................................................................................... 190

Limitations on Third-Party Cookies............................................................................ 192

Security Engineering Cheat Sheet............................................................................ 195

When Building Web Applications on Internal Networks................................ 195

When Launching Non-HTTP Services, Particularly on Nonstandard Ports ......... 195

When Using Third-Party Cookies for Gadgets or Sandboxed Content ............. 195

CONTENT RECOGNITION MECHANISMS 197

Document Type Detection Logic............................................................................... 198

Malformed MIME Types............................................................................ 199

Special Content-Type Values...................................................................... 200

Unrecognized Content Type ...................................................................... 202

Defensive Uses of Content-Disposition ......................................................... 203

Content Directives on Subresources ............................................................ 204

Downloaded Files and Other Non-HTTP Content ......................................... 205

Character Set Handling ......................................................................................... 206

Byte Order Marks .................................................................................... 208

Character Set Inheritance and Override ...................................................... 209

Markup-Controlled Charset on Subresources................................................ 209

Detection for Non-HTTP Files...................................................................... 210

Security Engineering Cheat Sheet............................................................................ 212

Good Security Practices for All Websites..................................................... 212

When Generating Documents with Partly Attacker-Controlled Contents ........... 212

When Hosting User-Generated Files ........................................................... 212

DEALING WITH ROGUE SCRIPTS 213

Denial-of-Service Attacks ........................................................................................ 214

Execution Time and Memory Use Restrictions............................................... 215

Connection Limits ..................................................................................... 216

Pop-Up Filtering ....................................................................................... 217

Dialog Use Restrictions.............................................................................. 218

Window-Positioning and Appearance Problems ........................................................ 219

Timing Attacks on User Interfaces ............................................................................ 222

Contents in Detail xv

Security Engineering Cheat Sheet............................................................................ 224

When Permitting User-Created <iframe> Gadgets on Your Site...................... 224

When Building Security-Sensitive UIs .......................................................... 224

EXTRINSIC SITE PRIVILEGES 225

Browser- and Plug-in-Managed Site Permissions ........................................................ 226

Hardcoded Domains ................................................................................ 227

Form-Based Password Managers............................................................................. 227

Internet Explorer’s Zone Model ............................................................................... 229

Mark of the Web and Zone.Identifier ......................................................... 231

Security Engineering Cheat Sheet............................................................................ 232

When Requesting Elevated Permissions from Within a Web Application ......... 232

When Writing Plug-ins or Extensions That Recognize Privileged Origins.......... 232

PART III: A GLIMPSE OF THINGS TO COME 233

NEW AND UPCOMING SECURITY FEATURES 235

Security Model Extension Frameworks ..................................................................... 236

Cross-Domain Requests ............................................................................. 236

XDomainRequest ...................................................................................... 239

Other Uses of the Origin Header ............................................................... 240

Security Model Restriction Frameworks .................................................................... 241

Content Security Policy.............................................................................. 242

Sandboxed Frames .................................................................................. 245

Strict Transport Security............................................................................. 248

Private Browsing Modes............................................................................ 249

Other Developments .............................................................................................. 250

In-Browser HTML Sanitizers........................................................................ 250

XSS Filtering ............................................................................................ 251

Security Engineering Cheat Sheet............................................................................ 253

OTHER BROWSER MECHANISMS OF NOTE 255

URL- and Protocol-Level Proposals ............................................................................ 256

Content-Level Features............................................................................................ 258

I/O Interfaces....................................................................................................... 259

COMMON WEB VULNERABILITIES 261

Vulnerabilities Specific to Web Applications............................................................. 262

Problems to Keep in Mind in Web Application Design............................................... 263

Common Problems Unique to Server-Side Code ........................................................ 265

xviii Preface

and implementation shortcomings of the World Wide Web are those of a

technology that never aspired to its current status and never had a chance

to pause and look back at previous mistakes. The resulting issues have quickly

emerged as some of the most significant and prevalent threats to data secu-

rity today: As it turns out, the protocol design standards one would apply to

a black-on-gray home page full of dancing hamsters are not necessarily the

same for an online shop that processes millions of credit card transactions

every year.

When taking a look at the past decade, it is difficult not to be slightly

disappointed: Nearly every single noteworthy online application devised so

far has had to pay a price for the corners cut in the early days of the Web.

Heck, xssed.com, a site dedicated to tracking a narrow subset of web-related

security glitches, amassed some 50,000 entries in about three years of opera-

tion. Yet, browser vendors are largely unfazed, and the security community

itself has offered little insight or advice on how to cope with the widespread

misery. Instead, many security experts stick to building byzantine vulnerabil-

ity taxonomies and engage in habitual but vague hand wringing about the

supposed causes of this mess.

Part of the problem is that said experts have long been dismissive of the

whole web security ruckus, unable to understand what it was all about. They

have been quick to label web security flaws as trivial manifestations of the

confused deputy problem

or of some other catchy label outlined in a trade jour-

nal three decades ago. And why should they care about web security, anyway?

What is the impact of an obscene comment injected onto a dull pet-themed

home page compared to the gravity of a traditional system-compromise flaw?

In retrospect, I’m pretty sure most of us are biting our tongues. Not only

has the Web turned out to matter a lot more than originally expected, but

we’ve failed to pay attention to some fundamental characteristics that put

it well outside our comfort zone. After all, even the best-designed and most

thoroughly audited web applications have far more issues, far more frequently,

than their nonweb counterparts.

We all messed up, and it is time to repent. In the interest of repentance,

The Tangled Web tries to take a small step toward much-needed normalcy, and

as such, it may be the first publication to provide a systematic and thorough

analysis of the current state of affairs in the world of web application security.

In the process of doing so, it aims to shed light on the uniqueness of the secu-

rity challenges that we—security engineers, web developers, and users—have

to face every day.

The layout of this book is centered on exploring some of the most prom-

inent, high-level browser building blocks and various security-relevant topics

derived from this narrative. I have taken this approach because it seems to be

more informative and intuitive than simply enumerating the issues using an

Confused deputy problem is a generic concept in information security used to refer to a broad

class of design or implementation flaws. The term describes any vector that allows the attacker

to trick a program into misusing some “authority” (access privileges) to manipulate a resource

in an unintended manner—presumably one that is beneficial to the attacker, however that

benefit is defined. The phrase “confused deputy” is regularly invoked by security researchers

in academia, but since virtually all real-world security problems could be placed in this bucket

when considered at some level of abstraction, this term is nearly meaningless.

剩余323页未读，继续阅读

u010558072

粉丝: 0
资源: 1

现代Web应用安全指南：解密错综复杂的网络世界

The TANGLED WEB - A guide to securing modern web application

The Tagled Web A Guide to Securing Modern Web Applications 英文原版

《The Tangled Web》：“破解Web乱局”324页完整、文字(非扫描)PDF版

the tangled web

The Tangled Web

Python库 | tangled.web-0.1a8.tar.gz

The Tangle Web

tangled-tulle

pku acm 2075 Tangled in Cables 代码

Tangled Wallpapers and New Tab Themes-crx插件

最新资源