A tangled web
It all begins with Great Aunt Becky and her infamous prized possession: a legendary heirloom jug. After her death, everyone wants it. But the name of the new owner will not be revealed for one year... Over the next twelve months, scandals, quarrels and love affairs abound within the Dark and Penhallow clans - with the jug at the centre of it all. Engagements are broken; lifelong mutual hatred blossoms into romance; lovers separated years ago are reunited. But then comes the night that the eccentric matriarch's wishes will be revealed - and both families are in for the biggest surprise of them all.
Stats for nerds
2recommend
5mentions
2people
2013–2017years
100% recommend
Mentions per year
What Hacker News says
- I didn't read that out of The Tangled Web. It did cover attacks, but it was also a solid guide on shoring up defenses for developers.
To circle back to your question - nginx is fairly robust out of the box, but The Tangled Web will cover extra configuration steps. For example - how to securely handle and serve files uploaded by users, including file naming conventions.
Other best practices for configuring things like TLS and CORS will also be covered, which are in the purview of any developer setting up a web server. My interpretation of the book was that it covered attacks that are executed through the browser (especially via user input) insofar as it's instructive for developers to learn how to avoid them.
- Glad you asked. This is a list I like to call, "how to become an extremely effective and formidable security engineer."
1. The Web Application Hacker's Handbook
Probably the first book you want to read; this will teach you the core mindset you need for finding security flaws in web applications as well as give a very strong foundation for the different classes of vulnerabilities.
2. The Mobile Application Hacker's Handbook
Good supplement to #1 for application security, obviously focused on mobile apps.
3. The Art of Software Security Assessment
The bible of the security industry. Especially instructive for source code review.
4. Security Engineering (Ron Anderson)
Supplements #3. Very instructive for injecting security into the overall SDLC and designing secure software.
5. The Tangled Web
Excellent historical background and good high level overview of many information security topics. Every engineer should read this, even if they don't work in security.
6. Gray Hat Python
Very hands on, good introduction to aspects of reverse engineering and the typical work an e.g. security consultant will do at a top firm.
7. Practical Malware Analysis
Very good introduction to malware analysis.
8. Practical Reverse Engineering
This book, along with #9 will teach you everything you need to know to effectively reverse engineer software for security-focused analysis.
9. Reversing: Secrets of Reverse Engineering
10. The IDA Pro Book
You'll want this if you have any plan to work with IDA Pro at all, which is the gold standard for decompiling and reversing software.
11. The Shellcoder's Handbook
If you'd like to write exploits after you're done reversing software to find an exploitable bug, this is a good book to pick up.
12. Cryptography Engineering
Very solid and broad introduction to cryptography. Every engineer should read this, even if they don't work in security.
13. Introduction to Modern Cryptography
This book, along with #14 is what you want to read if you're going to work as a cryptographer or cryptanalyst professionally.
14. Handbook of Applied Cryptography
--------------------------------------
Theoretically, these books should resolve your known-unknowns and your unknown-unknowns. Anyone who reads and works through the list should be capable of designing secure software, finding errors in white and black box source code reviews and finding errors in white and black box penetration tests.
If you're looking to get into this professionally, feel free to contact me if you have any questions and I'll do my best to help.
- To add some color to this great suggestion - The Web Application Hacker's Handbook is a better resource for learning to break web applications than for learning to build them properly. It will teach you every about almost every vulnerability that can be classified and how to find it.
The Tangled Web is better for learning the underlying causes of various issues presented in the former book and for learning how to prevent them. It has excellent, practical checklists at the end of every chapter for anyone building an application.
- ^^ Exhibit A: One of the firms you'd want to try your hand at working for first :)
They might also send / you'd want to read:
- Gray Hat Python (debugging and fuzzing with Python)
- The Tangled Web (web browser security and insecurity)
- The Art of Software Security Assessment - the bible, which you really want to read as it's a foundational text. Very dense, but you'll come out of it knowing how to attack memory very well.
- You might try The Tangled Web. I've only read a few of the early chapters, but those at least seem good.
