کتاب امنیت برنامه‌های وب، ویرایش دوم

تاریخچه امنیت نرم‌افزار

The Origins of Hacking • The Enigma Machine, Circa 1930 • Automated Enigma Code Cracking, Circa 1940 • Telephone “Phreaking,” Circa 1950 • Anti-Phreaking Technology, Circa 1960 • The Origins of Computer Hacking, Circa 1980 • The Rise of the World Wide Web, Circa 2000 • Hackers in the Modern Era, Circa 2015+ • Summary

مقدمه‌ای بر شناسایی برنامه‌های وب

Information Gathering • Web Application Mapping • Summary

ساختار یک برنامه وب مدرن

Modern Versus Legacy Web Applications • REST APIs • JavaScript Object Notation • JavaScript • Variables and Scope • Functions • Context • Prototypal Inheritance • Asynchrony • Browser DOM • SPA Frameworks • Authentication and Authorization Systems • Authentication • Authorization • Web Servers • Server-Side Databases • Client-Side Data Stores • GraphQL • Version Control Systems • CDN/Cache • Summary

یافتن زیردامنه‌ها

Multiple Applications per Domain • The Browser’s Built-In Network Analysis Tools • Taking Advantage of Public Records • Search Engine Caches • Accidental Archives • Social Snapshots • Zone Transfer Attacks • Brute Forcing Subdomains • Dictionary Attacks • Summary

تحلیل API

Endpoint Discovery • Authentication Mechanisms • Endpoint Shapes • Common Shapes • Application-Specific Shapes • Summary

شناسایی وابستگی‌های شخص ثالث

Detecting Client-Side Frameworks • Detecting SPA Frameworks • Detecting JavaScript Libraries • Detecting CSS Libraries • Detecting Server-Side Frameworks • Header Detection • Default Error Messages and 404 Pages • Database Detection • Summary

شناسایی نقاط ضعف در معماری برنامه

Secure Versus Insecure Architecture Signals • Multiple Layers of Security • Adoption and Reinvention • Summary

خلاصه بخش اول

مقدمه‌ای بر هک برنامه‌های وب

The Hacker’s Mindset • Applied Recon

اسکریپت‌نویسی بین‌سایتی

XSS Discovery and Exploitation • Stored XSS • Reflected XSS • DOM-Based XSS • Mutation-Based XSS • Bypassing Filters • Self-Closing HTML Tags • Protocol-Relative URLs • Malformed Tags • Encoding Escapes • Polyglot Payloads • XSS Sinks and Sources • Summary

جعل درخواست بین‌سایتی

Query Parameter Tampering • Alternate GET Payloads • CSRF Against POST Endpoints • Bypassing CSRF Defenses • Header Validation • Token Pools • Weak Tokens • Content Types • Regex Filter Bypasses • Iframe Payloads • AJAX Payloads • Zero Interaction Forms • Summary

موجودیت خارجی XML

XXE Fundamentals • Direct XXE • Indirect XXE • Out-of-Band Data Exfiltration • Account Takeover Workflow • Obtaining System User Data • Obtaining Password Hashes • Cracking Password Hashes • SSH Remote Login • Summary

تزریق

SQL Injection • Code Injection • Command Injection • Injection Data Exfiltration Techniques • Data Exfiltration Fundamentals • In-Band Data Exfiltration • Out-of-Band Data Exfiltration • Inferential Data Exfiltration • Bypassing Common Defenses • Summary

حمله محروم‌سازی از سرویس

Regex DoS • Logical DoS Vulnerabilities • Distributed DoS • Advanced DoS • YoYo Attacks • Compression Attacks • Proxy-Based DoS • Summary

حمله به داده‌ها و اشیاء

Mass Assignment • Insecure Direct Object Reference • Serialization Attacks • Web Serialization Explained • Attacking Weak Serialization • Summary

حملات سمت کلاینت

Methods of Attacking a Browser Client • Client-Targeted Attacks • Client-Specific Attacks • Advantages of Client-Side Attacks • Prototype Pollution Attacks • Understanding Prototype Pollution • Attacking with Prototype Pollution • Prototype Pollution Archetypes • Clickjacking Attacks • Camera and Microphone Exploit • Creating Clickjacking Exploits • Tabnabbing and Reverse Tabnabbing • Traditional Tabnabbing • Reverse Tabnabbing • Summary

بهره‌برداری از وابستگی‌های شخص ثالث

Methods of Integration • Branches and Forks • Self-Hosted Application Integrations • Source Code Integration • Package Managers • JavaScript • Java • Other Languages • Common Vulnerabilities and Exposures Database • Summary

آسیب‌پذیری‌های منطق کسب‌وکار

Custom Math Vulnerabilities • Programmed Side Effects • Quasi-Cash Attacks • Vulnerable Standards and Conventions • Exploiting Business Logic Vulnerabilities • Summary

خلاصه بخش دوم

ایمن‌سازی برنامه‌های وب مدرن

Defensive Software Architecture • Comprehensive Code Reviews • Vulnerability Discovery • Vulnerability Analysis • Vulnerability Management • Regression Testing • Mitigation Strategies • Applied Recon and Offense Techniques • Summary

معماری امن برنامه

Analyzing Feature Requirements • Authentication and Authorization • Secure Sockets Layer and Transport Layer Security • Secure Credentials • Hashing Credentials • MFA • PII and Financial Data • Search Engines • Zero Trust Architecture • The History of Zero Trust • Implicit Versus Explicit Trust • Authentication and Authorization • Summary

پیکربندی امن برنامه

Content Security Policy • Implementing CSP • CSP Structure • Important Directives • CSP Sources and Source Lists • Strict CSP • Example Secure CSP Policy • Cross-Origin Resource Sharing • Types of CORS Requests • Simple CORS Requests • Preflighted CORS Requests • Implementing CORS • Headers • Strict Transport Security • Cross-Origin-Opener Policy (COOP) • Cross-Origin-Resource-Policy (CORP) • Headers with Security Implications • Legacy Security Headers • Cookies • Creating and Securing Cookies • Testing Cookies • Framing and Sandboxing • Traditional Iframe • Web Workers • Subresource Integrity • Shadow Realms • Summary

تجربه کاربری امن

Information Disclosures and Enumeration • Information Disclosures • Enumeration • Secure User Experience Best Practices • Summary

مدل‌سازی تهدید برنامه‌ها

Designing an Effective Threat Model • Threat Modeling by Example • Logic Design • Technical Design • Threat Identification (Threat Actors) • Threat Identification (Attack Vectors) • Identifying Mitigations • Delta Identification • Summary

بازبینی کد برای امنیت

How to Start a Code Review • Archetypical Vulnerabilities Versus Business Logic Vulnerabilities • Where to Start a Security Review • Secure-Coding Anti-Patterns • Blocklists • Boilerplate Code • Trust-by-Default • Client/Server Separation • Summary

کشف آسیب‌پذیری

Security Automation • Static Analysis • Dynamic Analysis • Vulnerability Regression Testing • Responsible Disclosure Programs • Bug Bounty Programs • Third-Party Penetration Testing • Summary

مدیریت آسیب‌پذیری

Reproducing Vulnerabilities • Ranking Vulnerability Severity • Common Vulnerability Scoring System • CVSS: Base Scoring • CVSS: Temporal Scoring • CVSS: Environmental Scoring • Advanced Vulnerability Scoring • Beyond Triage and Scoring • Summary

دفاع در برابر حملات XSS

Anti-XSS Coding Best Practices • Sanitizing User Input • DOMParser Sink • SVG Sink • Blob Sink • Sanitizing Hyperlinks • HTML Entity Encoding • CSS XSS • Content Security Policy for XSS Prevention • Script Source • Unsafe Eval and Unsafe Inline • Implementing a CSP • Summary

دفاع در برابر حملات CSRF

Header Verification • CSRF Tokens • Anti-CRSF Coding Best Practices • Stateless GET Requests • Application-Wide CSRF Mitigation • Summary

دفاع در برابر XXE

Evaluating Other Data Formats • Advanced XXE Risks • Summary

دفاع در برابر تزریق

Mitigating SQL Injection • Detecting SQL Injection • Prepared Statements • Database-Specific Defenses • Generic Injection Defenses • Potential Injection Targets • Principle of Least Authority • Allowlisting Commands • Summary

دفاع در برابر حملات DoS

Protecting Against Regex DoS • Protecting Against Logical DoS • Protecting Against DDoS • Summary

دفاع از داده‌ها و اشیاء

Defending Against Mass Assignment • Validation and Allowlisting • Data Transfer Objects • Defending Against IDOR • Defending Against Serialization Attacks • Summary

دفاع در برابر حملات سمت کلاینت

Defending Against Prototype Pollution • Key Sanitization • Prototype Freezing • Null Prototypes • Defending Against Clickjacking • Frame Ancestors • Framebusting • Defending Against Tabnabbing • Cross-Origin-Opener Policy • Link Blockers • Isolation Policies • Summary

ایمن‌سازی وابستگی‌های شخص ثالث

Evaluating Dependency Trees • Modeling a Dependency Tree • Dependency Trees in the Real World • Automated Evaluation • Secure Integration Techniques • Separation of Concerns • Secure Package Management • Summary

کاهش آسیب‌پذیری‌های منطق کسب‌وکار

Architecture-Level Mitigations • Statistical Modeling • Modeling Inputs • Modeling Actions • Model Development • Model Analysis • Summary

خلاصه بخش سوم