عنوان

The Browser Hacker's Handbook /

(Number (ISBN

1118662105 (electronic bk.)

(Number (ISBN

111891435X (electronic bk.)

(Number (ISBN

1306473446 (MyiLibrary)

(Number (ISBN

9781118662106 (electronic bk.)

(Number (ISBN

9781118914359 (electronic bk.)

(Number (ISBN

9781306473446 (MyiLibrary)

Erroneous ISBN

1118662091

Erroneous ISBN

9781118662090

Number

dltt

Title Proper

The Browser Hacker's Handbook /

General Material Designation

[Book]

First Statement of Responsibility

Wade Alcorn, Christian Frichot, Michele Orrù.

Specific Material Designation and Extent of Item

1 online resource (xxi, 626 pages) :

Other Physical Details

illustrations

Text of Note

Includes bibliographical references and index

Text of Note

Copyright; About the Authors; About the Contributing Authors; About the Technical Editor; Credits; Acknowledgments; Contents; Introduction; Chapter 1: Web Browser Security; A Principal Principle; Exploring the Browser; Symbiosis with the Web Application; Same Origin Policy; HTTP Headers; Markup Languages; HTML; XML; Cascading Style Sheets; Scripting; JavaScript; VBScript; Document Object Model; Rendering Engines; WebKit; Trident; Gecko; Presto; Blink; Geolocation; Web Storage; Cross-origin Resource Sharing; HTML5; WebSocket; Web Workers; History Manipulation; WebRTC; Vulnerabilities

Text of Note

Web Browser Security -- Initiating Control -- Retaining Control -- Bypassing the Same Origin Policy -- Attacking Users -- Attacking Browsers -- Attacking Extensions -- Attacking Plugins -- Attacking Web Applications -- Attacking Networks -- Epilogue: Final Thoughts

Text of Note

Evolutionary Pressures HTTP Headers; Content Security Policy; Secure Cookie Flag; HttpOnly Cookie Flag; X-Content-Type-Options; Strict-Transport-Security; X-Frame-Options; Reflected XSS Filtering; Sandboxing; Browser Sandboxing; IFrame Sandboxing; Anti-phishing and Anti-malware; Mixed Content; Core Security Problems; Attack Surface; Rate of Change; Silent Updating; Extensions; Plugins; Surrendering Control; TCP Protocol Control; Encrypted Communication; Same Origin Policy; Fallacies; Robustness Principle Fallacy; External Security Perimeter Fallacy; Browser Hacking Methodology; Initiating

Text of Note

Exploiting Caching Summary; Questions; Notes; Chapter 3: Retaining Control; Understanding Control Retention; Exploring Communication Techniques; Using XMLHttpRequest Polling; Using Cross-origin Resource Sharing; Using WebSocket Communication; Using Messaging Communication; Using DNS Tunnel Communication; Exploring Persistence Techniques; Using IFrames; Using Full Browser Frame Overlay; Using Browser Events; Using Pop-Under Windows; Using Man-in-the-Browser Attacks; Hijacking AJAX Calls; Hijacking Non-AJAX Requests; Evading Detection; Evasion using Encoding; Base64 Encoding; Whitespace Encoding

Text of Note

Non-alphanumeric JavaScript Evasion using Obfuscation; Random Variables and Methods; Mixing Object Notations; Time Delays; Mixing Content from Another Context; Using the callee Property; Evasion using JavaScript Engines Quirks; Summary; Questions; Notes; Chapter 4: Bypassing the Same; Understanding the Same Origin Policy; Understanding the SOP with the DOM; Understanding the SOP with CORS; Understanding the SOP with Plugins; Understanding the SOP with UI Redressing; Understanding the SOP with Browser History; Exploring SOP Bypasses; Bypassing SOP in Java; Bypassing SOP in Adobe Reader. Bypassing SOP in Adobe Flash

Text of Note

Retaining Attacking; Summary; Questions; Notes; Chapter 2: Initiating Control; Understanding Control Initiation; Control Initiation Techniques; Using Cross-site Scripting Attacks; Reflected Cross-site Scripting; Stored Cross-site Scripting; DOM Cross-site Scripting; Universal Cross-site Scripting; XSS Viruses; Bypassing XSS Controls; Using Compromised Web Applications; Using Advertising Networks; Using Social Engineering Attacks; Phishing Attacks; Baiting; Anti-Phishing Controls; Using Man-in-the-Middle Attacks; Man-in-the-Browser; Wireless Attacks; ARP Spoofing; DNS Poisoning

0

0

8

8

8

8

Text of Note

Hackers exploit browser vulnerabilities to attack deep within networks. The Browser Hacker's Handbook gives a practical understanding of hacking the everyday web browser and using it as a beachhead to launch further attacks deep into corporate networks. Written by a team of highly experienced computer security experts, the handbook provides hands-on tutorials exploring a range of current attack methods. The web browser has become the most popular and widely used computer "program" in the world. As the gateway to the Internet, it is part of the storefront to any business that operates online, but it is also one of the most vulnerable entry points of any system. With attacks on the rise, companies are increasingly employing browser-hardening techniques to protect the unique vulnerabilities inherent in all currently used browsers. The Browser Hacker's Handbook thoroughly covers complex security issues and explores relevant topics such as: Bypassing the Same Origin Policy; ARP spoofing, social engineering, and phishing to access browsers; DNS tunneling, attacking web applications, and proxying--all from the browser; Exploiting the browser and its ecosystem (plugins and extensions); Cross-origin attacks, including Inter-protocol Communication and Exploitation. The Browser Hacker's Handbook is written with a professional security engagement in mind. Leveraging browsers as pivot points into a target's network should form an integral component into any social engineering or red-team security assessment. This handbook provides a complete methodology to understand and structure your next browser penetration test.--

Source for Acquisition/Subscription Address

OverDrive, Inc.

Stock Number

51968B98-C2E3-457B-8AC5-603D813916D8

Title

Browser hacker's handbook.

International Standard Book Number

9781118662090

Browsers (Computer programs)-- Security measures.

Computer networks-- Access control.

Computer networks-- Security measures.

COM-- 043050

COM-- 053000

COM-- 060040

Number

Edition

Class number

Class number

Book number

Alcorn, Wade.

Frichot, Christian.

Orrù, Michele.

Date of Transaction

20140903101354.0

Cataloguing Rules (Descriptive Conventions))

rda

Electronic name

[Book]

Y