2KKUU7ita

Chapter 14: Websites and Applications
✓ Use CAPTCHA (also reCAPTCHA) or web login forms to help prevent
password-cracking attempts.
✓ Employ an intruder lockout mechanism on your web server or within
your web applications to lock user accounts after 10–15 failed login
attempts. This chore can be handled via session tracking or via a thirdparty
web application firewall add-on like I discuss in the later section
“Putting up firewalls.”
✓ Check for and change any vendor default passwords to something that’s
easy to remember yet difficult to crack.
Web 2.0 is changing how the Internet is used.
From YouTube to Facebook to Twitter, new
server and client-side technologies, such as
web services, Ajax, and Flash, are being rolled
out as if they’re going out of style. And these
aren’t just consumer technologies. Businesses
see the value in them, and developers are
excited to utilize the latest and greatest technologies
in their environments.
Unfortunately, the downside to Web 2.0 is
complexity. These new rich Internet applications,
as many call them, are so complex that
developers, quality assurance analysts, and
security managers are struggling to keep up
with all their associated security issues. Don’t
get me wrong, the vulnerabilities in Web 2.0
applications are very similar to what show up
with legacy technologies, such as XSS, SQL
injection, parameter manipulation, and so on.
The problem is that automated web vulnerability
scanners aren’t quite mature enough — at
least as of this writing — to find all the security
weaknesses that count. When assessing the
security of Web 2.0 applications, I find that most
Hacking Web 2 .0
of them have to be analyzed manually. I’m sure
that will change as tool vendors improve things.
In the meantime, here are some valuable tools
you can use to test for flaws in your Web 2.0
applications:
✓ Firefox Web Developer (http://
chrispederick.com/work/
web-developer) for analyzing script
code and performing other manual checks.
✓ SWFScan (http://bit.ly/ShyhVz)
for decompiling and analyzing Shockwave
Flash (.swf) files.
✓ WSDigger (www.mcafee.com/us/
downloads/free-tools/ws
digger.aspx) for analyzing web services.
✓ WSFuzzer (www.owasp.org/index.
php/Category:OWASP_WSFuzzer_
Project) for analyzing web services.
Web 2.0 applications are here to stay, so try to get
your arms around their security issues now before
the technology grows even more complex.
299