Web 2.0 Security - Defending AJAX, RIA, AND SOA
SECTION 1 - WEB2.0 INTRODUCTION AND SECURITY Chapter 1 Web 2.0 Apps - Introduction and Components Chapter objectives Web 2.0 introduction and security concerns Web 2.0 application evolution and architecture - SOA, Ajax & RIA Web 2.0 application information flow Web 2.0 application - components, technologies & security Conclusion References and readings Chapter 2 Web 2.0 - Languages and Protocols Chapter objectives Web 2.0 application layers Application server side languages Application client side languages Transport protocols Information and data structures Web 2.0 toolkits and frameworks Conclusion References and readings Chapter 3 Security issues around Web 2.0 Chapter objectives Web 2.0 attack points Web 2.0 threats and its impacts Web 2.0 Vulnerabilities and threat modeling Web 2.0 analysis frameworks Web 2.0 security controls Conclusion References and readings Case Study 1 - BlueFlakes : Community portal Leveraging Web 2.0 and security SECTION 2 - WEB2.0 APPLICATION PROFILING & VULNERABILITY MAPPING Chapter 4 Footprinting & Discovering Web 2.0 resources Chapter objectives Target (host) identification Methods of application footprinting XML services footprinting Conclusion References and readings Chapter 5 Scanning and Vulnerability mapping for Web 2.0 apps Chapter objectives Crawling web application Browsing the application and collecting information - Ajax calls Identifying potential targets Data exchange analysis and stream identification Mapping resource for potential vulnerabilities Conclusion References and readings Case Study 2 - BlueBank : Profiling Banking application - SECTION 3 - WEB2.0 ATTACK VECTORS AND COUNTERMEASURE Chapter 6 Ajax security Chapter objectives Ajax security issues Ajax streams and information exchange Ajax and DOM manipulation Client side security vulnerabilities - XSS & XSRF with case Ajax end points - server side issues Countermeasure for Ajax security Conclusion References and readings Chapter 7 Rich internet application security Chapter objectives RIA security issues Flash based application and decoding Reverse engineering the flash Cross domain issues Countermeasure for RIA security Conclusion References and readings Chapter 8 SOA security - XML-RPC, REST & SOAP Chapter objectives SOA security issues Entry points analysis for XML services XML-RPC attacks REST application attacks SOAP based applications and security holes Ajax interaction with XML services and security flaws Countermeasures for XML services Conclusion References and readings Chapter 9 Browser security & Web 2.0 Exploits Chapter objectives Browser security overview Cross domain issues Client side exploitation and engines Defending and countermeasures Conclusion References and readings SECTION 4 - WEB 2.0 APPLICATION TESTING AND HARDENING Chapter 10 Web 2.0 application fuzzing and vulnerability mapping Chapter objectives Web 2.0 application fuzzing Building a tool to fuzz Fuzzing web services Fuzzing client side with streams Vulnerability detection with fuzzing Conclusion References and readings Chapter 11 Secure coding for Web 2.0 applications Chapter objectives Whitebox approach with code review Building a code review tool Secure coding with Web 2.0 Hardening Web 2.0 holes with code Conclusion References and readings Chapter 12 Hardening Web 2.0 application with configurations and content filtering Chapter objectives Deployment and configuration testing Hardening configuration Scanning tool for configuration Content filtering concept Filtering with Apache Filtering with IIS Browser filtering with javascripts Conclusion References and readings SECTION 5 - APPENDIX