Robert Hansen

Seth Fogie

Jeremiah Grossman

Anton Rager

Petko D. Petkov

A cross site scripting attack is a very specific type of attack on a web application. It is used by hackers to mimic real sites and fool people into providing personal data. XSS Attacks starts by defining the terms and laying out the ground work. It assumes that the reader is familiar with basic web programming (HTML) and JavaScript. First it discusses the concepts, methodology, and technology that makes XSS a valid concern. It then moves into the various types of XSS attacks, how they are implemented, used, and abused. After XSS is thoroughly explored, the next part provides examples of XSS malware and demonstrates real cases where XSS is a dangerous risk that exposes internet users to remote access, sensitive data theft, and monetary losses. Finally, the book closes by examining the ways developers can avoid XSS vulnerabilities in their web applications, and how users can avoid becoming a victim. The audience is web developers, security practitioners, and managers. XSS Vulnerabilities exist in 8 out of 10 Web sites The authors of this book are the undisputed industry leading authorities Contains independent, bleeding edge research, code listings and exploits that can not be found anywhere else

Cross Site Scripting Exploits and Defense

XSS Attacks

Michael Gregg

Craig Schiller

Colby DeRodeff

An all-star cast of authors analyze the top IT security threats for 2008 as selected by the editors and readers of Infosecurity Magazine. This book, compiled from the Syngress Security Library, is an essential reference for any IT professional managing enterprise security. It serves as an early warning system, allowing readers to assess vulnerabilities, design protection schemes and plan for disaster recovery should an attack occur. Topics include Botnets, Cross Site Scripting Attacks, Social Engineering, Physical and Logical Convergence, Payment Card Industry (PCI) Data Security Standards (DSS), Voice over IP (VoIP), and Asterisk Hacking. Each threat is fully defined, likely vulnerabilities are identified, and detection and prevention strategies are considered. Wherever possible, real-world examples are used to illustrate the threats and tools for specific solutions. * Provides IT Security Professionals with a first look at likely new threats to their enterprise * Includes real-world examples of system intrusions and compromised data * Provides techniques and strategies to detect, prevent, and recover * Includes coverage of PCI, VoIP, XSS, Asterisk, Social Engineering, Botnets, and Convergence

InfoSecurity 2008 Threat Analysis

Cyrus Peikari

0672324881.ld A detailed guide to wireless vulnerabilities, written by authors who have first-hand experience with wireless crackers and their techniques. Wireless technology and Internet security are the two fastest growing technology sectors. Includes a bonus CD packed with powerful free and demo tools to audit wireless networks. Reviewed and endorsed by the author of WEPCrack, a well-known tool for breaking 802.11 WEP encryption keys. Maximum Wireless Securityis a practical handbook that reveals the techniques and tools crackers use to break into wireless networks, and that details the steps network administrators need to take to secure their systems. The authors provide information to satisfy the experts hunger for in-depth information with actual source code, real-world case studies, and step-by-step configuration recipes. The book includes detailed, hands-on information that is currently unavailable in any printed text -- information that has been gleaned from the authors work with real wireless hackers ("war drivers"), wireless security developers, and leading security experts. Cyrus Peikariis the chief technical officer for VirusMD Corporation and has several patents pending in the anti-virus field. He has published several consumer security software programs, including an encrypted instant messenger, a personal firewall, a content filter and a suite of network connectivity tools. He is a repeat speaker at Defcon. Seth Fogie, MCSE,is a former United State Navy nuclear engineer. After retiring, he has worked as a technical support specialist for a major Internet service provider. He is currently the director of engineering at VirusMD Corporation, where he works on next-generation wireless security software. He has been invited to speak at Defcon in 2003.

Maximum Wireless Security

Seth Fogie

Books

Your next favorite book is out there