05316nam 2200649 450 991046368480332120200520144314.01-118-66210-5(CKB)2670000000530895(EBL)1641459(SSID)ssj0001153869(PQKBManifestationID)11727952(PQKBTitleCode)TC0001153869(PQKBWorkID)11154479(PQKB)11130589(MiAaPQ)EBC1641459(CaSebORM)9781118662090(Au-PeEL)EBL1641459(CaPaEBR)ebr10842312(CaONFJC)MIL578595(OCoLC)871225516(EXLCZ)99267000000053089520140313h20142014 uy 0engur|n|---|||||txtccrThe browser hacker's handbook /Wade Alcorn, Christian Frichot, Michele Orrù1st editionIndianapolis, Indiana :Wiley,2014.©20141 online resource (650 p.)Includes index.1-118-66209-1 Includes bibliographical references and index.Copyright; About the Authors; About the Contributing Authors; About the Technical Editor; Credits; Acknowledgments; Contents; Introduction; Chapter 1: Web Browser Security; A Principal Principle; Exploring the Browser; Symbiosis with the Web Application; Same Origin Policy; HTTP Headers; Markup Languages; HTML; XML; Cascading Style Sheets; Scripting; JavaScript; VBScript; Document Object Model; Rendering Engines; WebKit; Trident; Gecko; Presto; Blink; Geolocation; Web Storage; Cross-origin Resource Sharing; HTML5; WebSocket; Web Workers; History Manipulation; WebRTC; VulnerabilitiesEvolutionary PressuresHTTP Headers; Content Security Policy; Secure Cookie Flag; HttpOnly Cookie Flag; X-Content-Type-Options; Strict-Transport-Security; X-Frame-Options; Reflected XSS Filtering; Sandboxing; Browser Sandboxing; IFrame Sandboxing; Anti-phishing and Anti-malware; Mixed Content; Core Security Problems; Attack Surface; Rate of Change; Silent Updating; Extensions; Plugins; Surrendering Control; TCP Protocol Control; Encrypted Communication; Same Origin Policy; Fallacies; Robustness Principle Fallacy; External Security Perimeter Fallacy; Browser Hacking Methodology; InitiatingRetainingAttacking; Summary; Questions; Notes; Chapter 2: Initiating Control; Understanding Control Initiation; Control Initiation Techniques; Using Cross-site Scripting Attacks; Reflected Cross-site Scripting; Stored Cross-site Scripting; DOM Cross-site Scripting; Universal Cross-site Scripting; XSS Viruses; Bypassing XSS Controls; Using Compromised Web Applications; Using Advertising Networks; Using Social Engineering Attacks; Phishing Attacks; Baiting; Anti-Phishing Controls; Using Man-in-the-Middle Attacks; Man-in-the-Browser; Wireless Attacks; ARP Spoofing; DNS PoisoningExploiting CachingSummary; Questions; Notes; Chapter 3: Retaining Control; Understanding Control Retention; Exploring Communication Techniques; Using XMLHttpRequest Polling; Using Cross-origin Resource Sharing; Using WebSocket Communication; Using Messaging Communication; Using DNS Tunnel Communication; Exploring Persistence Techniques; Using IFrames; Using Full Browser Frame Overlay; Using Browser Events; Using Pop-Under Windows; Using Man-in-the-Browser Attacks; Hijacking AJAX Calls; Hijacking Non-AJAX Requests; Evading Detection; Evasion using Encoding; Base64 Encoding; Whitespace EncodingNon-alphanumeric JavaScriptEvasion using Obfuscation; Random Variables and Methods; Mixing Object Notations; Time Delays; Mixing Content from Another Context; Using the callee Property; Evasion using JavaScript Engines Quirks; Summary; Questions; Notes; Chapter 4: Bypassing the Same; Understanding the Same Origin Policy; Understanding the SOP with the DOM; Understanding the SOP with CORS; Understanding the SOP with Plugins; Understanding the SOP with UI Redressing; Understanding the SOP with Browser History; Exploring SOP Bypasses; Bypassing SOP in Java; Bypassing SOP in Adobe ReaderBypassing SOP in Adobe FlashHackers exploit browser vulnerabilities to attack deep within networks The Browser Hacker's Handbook gives a practical understanding of hacking the everyday web browser and using it as a beachhead to launch further attacks deep into corporate networks. Written by a team of highly experienced computer security experts, the handbook provides hands-on tutorials exploring a range of current attack methods. The web browser has become the most popular and widely used computer ""program"" in the world. As the gateway to the Internet, it is part of the storefront to any business thatComputer hackersHandbooks, manuals, etcElectronic books.Computer hackers005.8Alcorn Wade870702Frichot Christian870703Orrù Michele870704MiAaPQMiAaPQMiAaPQBOOK9910463684803321The browser hacker's handbook1943983UNINA