Foreword

"My brain is the key that sets my mind free."
Harry Houdini

Hacking a web application is like performing a magic trick. If you know the right techniques and practice, you could break into just about any online bank, credit union, stock trader , e-commerce store, or social networking web site. Simply use a web browser as your magic wand and as fast as you can say, Open sesame!, you're in. And that's exactly what this book is all aboutindustry-leading web application experts revealing their best-kept web hacking secrets so people can begin defending themselves . The legendary magician Harry Houdini would be impressed with the techniques described in these pages.

The authors, as well all web application security experts, look at web sites differently than do most other people. With seemingly magical abilities , they can determine the operating system, programming language, web server version, and even the location of the vulnerabilities just by looking at a URL. Most experts will also admit that when they do business online, it's a painful and sometimes tempting experience. They're compelled by the curiosity of what happens when you inject a few special characters into the browser location bar. Could you dump the entire credit card database? How about when a purchase confirmation e-mail arrivescan we see other people's orders by simply changing numbers in the URL? Yes, is the likely answer, since most web sites can be compromised if you breathe on them too hard. Web application security is often so poor that experts occasionally find their hands covering up the location bar for fear of discovering vulnerabilities in their personal web bank. It's true that even the experts bury their heads in the sand now and then.

But the eyes of the criminals are wide open. Gone are the good ol' days when we only had to worry about prankster hackers vandalizing homepages with leet speak, and plastering offensive JPEGs where your logo used to be. Criminal hackers have taken over where the recreational breed left off. Every day they voraciously steal credit card numbers, passwords, birth dates, social security numbers, bank accounts, and anything else they can cash in on. The bad guys are willing, eager , and already blackmailing businesses at an alarming rate. And with hundreds of thousands of businesses in some way dependent on the Web, this is not an area of security we can afford to ignore. Have you sat down and seriously considered how much damage an intrusion would cause your operation in terms of downtime, fines , legal liability, loss of customer confidence, and brand damage?

The motivating factors of intruders have shifted over the years , but unsurprisingly one thing remains the samethe criminal mind takes the path of least resistance. Today this path is the web site, or specifically , the web applications because eight in ten have serious vulnerabilities. This is so serious that any sensitive data you hold could be lost. Also, prominent industry reports are placing web attacks and vulnerability disclosures at the top of the list. This means most, if not all web sites, will be attacked . It's just a matter of when, who does it, and how long before the attacks succeed. If yours happens to be one of the 80 percent of insecure web sites, then you're simply playing a waiting game and your unlucky number will eventually come up.

That's why web sites that claim to take security seriously, citing only the use of SSL, network-layer firewalls, and spiffy certification stickers, are unimpressive. Those are 20 ^th century solutions and make little difference defending against popular 21 ^st century attacks such Cross-Site Scripting, SQL Injection, and Insufficient Authorization. Clearly, we need a more effective approach, which is diligent implementation of secure software development best practices, platform security standards, application vulnerability scanning, and web application firewalls. As the situation currently stands, we are a long way away from a place where the security posture of most web sites is a deterrent or even a frustration to malicious hackers. Fortunately for those who truly want securitythose who don't want to be the next corporate victim or be listed in tomorrow's headlinethis book holds the information you need.

The Hacking Exposed Web Applications, Second Edition authors are well-known and respected industry experts who've lived on the digital battlefield. They know what works from firsthand experience pen-testing hundreds of web applications over the last decade . Collectively, they've researched hundreds (maybe thousands) of technical white papers, security books, articles, and vulnerability advisories. Each of them has published multiple works on security. They'll show you how to investigate web application internals from outside and in, how to spot and exploit the weak points, and most importantly, they'll describe the security measures that really make a difference. Joel, Mike, and Caleb have done a remarkable job capturing and presenting technical material in an easy-to-understand and engaging format. One thing is for certain: after you are done reading this book, you'll never look at a web site the same way again.

Jeremiah Grossman
Founder and CTO of WhiteHat Security
Co-Founder of the Web Application Security Consortium (WASC)
March 2006

Acknowledgments

This book would not have existed if not for the support, encouragement, input, and contributions of many people. We hope we have covered them all here and apologize for any omissions, which are due to our oversight alone.

First and foremost, many thanks to our families and friends for supporting us through many months of demanding research and writing. Their understanding and support were crucial to us completing this book. We hope that we can make up for the time we spent away from them to complete yet another book project (really, we promise this time!).

Secondly, we would like to thank our colleagues Nish, Sam, David, and Arian for their valuable contributions to this book. Ed Tracy also deserves special thanks for not becoming a schizophrenic while tech editing manuscripts with such different writing styles.

Of course, big thanks go again to the tireless McGraw-Hill production team who worked on the book, including our long-time acquisitions editor Jane Brownlow, acquisitions coordinator Jenni Housh, who kept things on track, and to project editor Mark Karmendy, who kept a cool head even in the face of weekend page proofing and other injustices that the authors saddled his team with.

We'd also like to acknowledge the many people who provided input and guidance on the many facets of this book, including Brian Cohen at SPI Dynamics, Ivan Ristic of ModSecurity and Thinking Stone, Heather Adkins of Google, J.D. Meier of Microsoft, and the entire Late-Night Drinking Crew at Casaba.

Thanks go also to Jeremiah Grossman for his feedback on the manuscript and his outstanding comments in the Foreword.

As always, we'd like to tip our hats to the many perceptive and creative hackers worldwide who continue to innovate and provide the raw material for Hacking Exposed , especially those who correspond regularly.

And finally, a tremendous "Thank You" to all of the readers of the Hacking Exposed series, whose ongoing support makes all of the hard work worthwhile.
Joel, Mike, and Caleb

I would like to acknowledge Mark Painter and George Hulme for help with my terrible writing, Kevin Spett for his technical contribution, and Ashley Vandiver for always pushing me.
Caleb