Half Title -- Title Page -- Copyright -- About the Author -- Acknowledgements -- Contents -- Introduction -- 1 HTML5 -- The New Document Object Model (DOM) -- Cross-Origin Resource Sharing (CORS) -- WebSockets -- Transferring Data -- Data Frames -- Security Considerations -- Web Storage -- IndexedDB -- Web Workers -- Flotsam & Jetsam -- History API -- Draft APIs -- Summary -- 2 HTML Injection & Cross-Site Scripting (XSS) -- Understanding HTML Injection -- Identifying Points of Injection -- URI Components -- Form Fields -- HTTP Request Headers & Cookies -- JavaScript Object Notation (JSON) -- Document Object Model (DOM) Properties -- Cascading Style Sheets (CSS) -- User-Generated Content -- Identifying the Type of Reflection -- Ephemeral -- Persistent -- Out of Band -- Identifying the Injection's Rendered Context -- Element Attributes -- Elements & Text Nodes -- JavaScript Variables -- Syntax Delimiters -- Putting the Hack Together -- Abusing Character Sets -- Attack Camouflage with Percent Encoding -- Encoding 0X00-Nothing Really Matters -- Alternate Encodings for the Same Character -- Why Encoding Matters for HTML Injection -- Exploiting Failure Modes -- Bypassing Weak Exclusion Lists -- Leveraging Browser Quirks -- The Unusual Suspects -- Subverting MIME Types -- Surprising MIME Types -- SVG Markup -- The Impact of XSS -- Data Redirection -- Employing Countermeasures -- Fixing a Static Character Set -- Normalizing Character Sets and Encoding -- Encoding the Output -- Beware of Exclusion Lists and Regexes -- Reuse, Don't Reimplement, Code -- JavaScript Sandboxes -- HTML5 Sandboxes -- Browsers' Built-In XSS Defenses -- Summary -- 3 Cross-Site Request Forgery (CSRF) -- Understanding Cross-Site Request Forgery -- The Mechanics of CSRF -- Request Forgery via Forced Browsing -- POST Forgery -- The Madness of Methods.

Attacking Authenticated Actions without Passwords -- Dangerous Liaison: CSRF and HTML Injection -- Be Wary of the Tangled Web -- Variation on a Theme: Clickjacking -- Employing Countermeasures -- Heading in the Right Direction -- A Dependable Origin -- An Unreliable Referer1 -- Custom Headers: X-Marks-the-Spot -- Shared Secrets -- Mirror the Cookie -- Require Manual Confirmation -- Understanding Same Origin Policy -- Anti-Framing via JavaScript -- Framing the Solution -- Defending the Web Browser -- Vulnerability & Verisimilitude -- Summary -- 4 SQL Injection & Data Store Manipulation -- Understanding SQL Injection -- Hacking Tangents: Mathematical and Grammatical -- Breaking SQL Statements -- Breaking Naive Defenses -- Exploiting Errors -- Inference -- Data Truncation -- Vivisecting the Database -- Extracting Information with Stacked Queries -- Controlling the Database & Operating System -- Alternate Attack Vectors -- Real-World SQL Injection -- HTML5's Web Storage API -- SQL Injection Without SQL -- Employing Countermeasures -- Validating Input -- Securing the Statement -- Parameterized Queries -- Stored Procedures -- .NET Language-Integrated Query (LINQ) -- Protecting Information -- Encrypting Data -- Segregating Data -- Stay Current with Database Patches -- Summary -- 5 Breaking Authentication Schemes -- Understanding Authentication Attacks -- Replaying the Session Token -- Reverse Engineering the Session Token -- Brute Force -- Success/Failure Signaling -- Sniffing -- Resetting Passwords -- Cross-Site Scripting (XSS) -- SQL Injection -- Gulls & Gullibility -- Employing Countermeasures -- Protect Session Cookies -- Regenerate Random Session Tokens -- Use Secure Authentication Schemes -- Cryptographically Hash the Password -- Protecting Passwords in Transit -- Password Recovery -- Alternate Authentication Frameworks -- OAuth 2.0 -- OpenID.

HTTP Strict-Transport-Security (HSTS) -- Engage the User -- Reinforce Security Boundaries -- Annoy the User -- Escalating Authentication Requirements -- Request Throttling -- Logging and Triangulation -- Defeating Phishing -- Protecting Passwords -- Summary -- 6 Abusing Design Deficiencies -- Understanding Logic & Design Attacks -- Abusing Workflows -- Exploiting Policies & Practices -- Induction -- Denial of Service -- Insecure Design Patterns -- Ambiguity, Undefined, & Unexpected Behavior -- Insufficient Authorization Verification -- Inadequate Data Sanitization -- Commingling Data & Code -- Incorrect Normalization & Synonymous Syntax -- Unhandled State Transitions -- Client-side Confidence -- Implementation Errors in Cryptography -- Insufficient Randomness -- XOR -- Attacking Encryption with Replay & Bit-Flipping -- Message Authentication Code Length-Extension Attacks -- Information Sieves -- Employing Countermeasures -- Documenting Requirements -- Creating Robust Test Cases -- Security Testing -- Learning From Mistakes -- Mapping Policies to Controls -- Defensive Programming -- Verifying the Client -- Encryption Guidelines -- Summary -- 7 Leveraging Platform Weaknesses -- Understanding the Attacks -- Recognizing Patterns, Structures, & Developer Quirks -- Relying on HTML & JavaScript to Remain Hidden -- Authorization By Obfuscation -- Pattern Recognition -- File Access & Path Traversal -- Predictable Identifiers -- Inside the Pseudo-Random Number Generator (PRNG) -- Creating a Phase Space Graph -- The Fallacy of Complex Manipulation -- Exposed APIs -- Poor Security Context -- Targeting the Operating System -- Executing Shell Commands -- Injecting PHP Commands -- Loading Commands Remotely -- Attacking the Server -- Denial of Service -- Network -- Attacking Programming Languages -- Regular Expressions -- Hash Collisions -- Employing Countermeasures.

Restricting file Access -- Using Object References -- Blacklisting Insecure Functions -- Enforcing Authorization -- Restricting Network Connections -- Web Application Firewalls -- Summary -- 8 Browser & Privacy Attacks -- Understanding Malware and Browser Attacks -- Malware -- Geographic Location -- User-Agent -- Referer -- Plugins -- Plugging in to Browser Plugins -- Insecure Plugins -- Malicious Plugins -- DNS and Origins -- Spoofing -- HTML5 -- Cross-Document Messaging -- Web Storage API -- Privacy -- Tracking Tokens -- Browser Fingerprinting -- Extended Verification Certificates -- Inconsistent Mobile Security -- Employing Countermeasures -- Configure SSL/TLS Securely -- Safer Browsing -- Useful Plugins -- Isolating the Browser -- Tor -- DNSSEC -- Summary -- Index -- A -- B -- C -- D -- E -- F -- G -- H -- I -- J -- K -- L -- M -- N -- O -- P -- Q -- R -- S -- T -- U -- V -- W -- X -- Z.