The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 1 

■

Web Application (In)security

5

70779c01.qxd:WileyRed  9/14/07  3:12 PM  Page 5

---

“This Site Is Secure”

There is a widespread awareness that security is an “issue” for web applica-

tions. Consult the FAQ page of a typical application, and you will be reassured

that it is in fact secure. For example:

This site is absolutely secure. It has been designed to use 128-bit Secure Socket

Layer (SSL) technology to prevent unauthorized users from viewing any of your

information. You may use this site with peace of mind that your data is safe with us.

In virtually every case, web applications state that they are secure because

they use SSL. Users are often urged to verify the site’s certificate, admire the

advanced cryptographic protocols in use, and on this basis, trust it with their

personal information.

In fact, the majority of web applications are insecure, and in ways that have

nothing to do with SSL. The authors of this book have tested hundreds of web

applications in recent years. Figure 1-3 shows the proportions of those appli-

cations tested during 2006 and 2007 that were found to be affected by some

common categories of vulnerability. These are explained briefly below:

■■