Name: The tangled Web
ISBN: 9781593273880

The tangled Web

"'Thorough and comprehensive coverage from one of the foremost experts in browser security.' --Tavis Ormandy, Google Inc. Modern web applications are built on a tangle of technologies that have been developed over time and then haphazardly pieced together. Every piece of the web application stack, from HTTP requests to browser-side scripts, comes with important yet subtle security consequences. To keep users safe, it is essential for developers to confidently navigate this landscape.In The Tangled Web, Michal Zalewski, one of the world's top browser security experts, offers a compelling narrative that explains exactly how browsers work and why they're fundamentally insecure. Rather than dispense simplistic advice on vulnerabilities, Zalewski examines the entire browser security model, revealing weak points and providing crucial information for shoring up web application security. You'll learn how to: Perform common but surprisingly complex tasks such as URL parsing and HTML sanitization Use modern security features like Strict Transport Security, CSP, and CORS Leverage many variants of the same-origin policy to safely compartmentalize complex web applications and protect user credentials in case of XSS bugs Build mashups and embed gadgets without getting stung by the tricky frame navigation policy Embed or host user-supplied content without running into the trap of content sniffing For quick reference, "Security Engineering Cheat Sheets' at the end of each chapter offer…

What Hacker News says

emmanueloga_Jun 2024

> early on, it plays tricks with your mind — what if I’m really as clueless as they say?

> What stings far more is when you get no reaction whatsoever

Wow, even someone like lcamtuf can feel like this sometimes. This guy is the author of super-awesome stuff like "The Tangled Web" book, the "Guerrilla guide to CNC" and the "american fuzzy lop" software. Definitely, his work is the kind of content that makes the internet 1000 times better!

thread

fullspectrumdevJan 2024

One security company I worked at had it as required reading for new hires - you were given a copy as part of onboarding.

I honestly think that was an excellent idea - there’s a good amount of valuable lessons for an analyst to glean from reading it.

I can think of very few other books in the IT security field that are as well written and as compelling besides maybe Silence on the Wire, The Tangled Web, or Innocent Code.

thread

sansnommeJul 2019

If you are looking for technical resources for internet security, books by Zalewski are pretty good for a conceptual understanding. (Silence on the Wire and The Tangled Web)

thread

rwmjSep 2018

More web app madness. The main lesson I took from Michal Zalewski's excellent book "The Tangled Web" was I hope I never have to write a web application. There are far too many traps.

thread

arkadiytJul 2018

There's no standard path in information security, most schools don't offer information security degrees and many extremely successful people in security didn't come from a CS background at all.

Some general recommendations:

- follow smart security people on Twitter, which is the defacto medium for information security discussion

- read publicly disclosed bug bounty reports on Hackerone and Bugcrowd

- read The Tangled Web by Michal Zalewski

- learn to use Burp Suite

thread

dmixMar 2018

If you don't know who this is, he wrote one of my favourite books on web (browser) security: "The Tangled Web" [1].

Another lesser known book by him is also worth a read: "Silence on the Wire" that takes a look at the full information security stack from the keyboard you type on, to the wires the data transits, to the internet protocols, etc [2] and looking at how each stage exposes/protects data.

And has quite an interesting history in infosec beyond that [3].

[1] https://www.amazon.com/Tangled-Web-Securing-Modern-Applicati...

[2] https://www.amazon.com/Silence-Wire-Passive-Reconnaissance-I...

[3] https://en.wikipedia.org/wiki/Micha%C5%82_Zalewski

thread