Hacking Exposed

Developing Secure Web Applications with Java Technology

By: Art Taylor, Brian Buege, Randy Layman

Write A Review

Paperback | 24 September 2002

At a Glance

Paperback
426 Pages

Dimensions(cm)
22.86 x 18.42 x 3.18

Paperback

$97.75

or 4 interest-free payments of $24.44 with

Ships in 5 to 10 business days

Written in the same exciting and informative style as the international blockbuster Hacking Exposed, this book provides comprehensive coverage of the tools and techniques for testing and correcting J2EE and Java security issues. Includes examples of J2EE attacks and countermeasures, risk ratings throughout the chapters and case studies.

Shipping

	Standard Shipping	Express Shipping
Metro postcodes:	$9.99	$14.95
Regional postcodes:	$9.99	$14.95
Rural postcodes:	$9.99	$14.95

Orders over $89.00 qualify for free shipping.

How to return your order

At Booktopia, we offer hassle-free returns in accordance with our returns policy. If you wish to return an item, please get in touch with Booktopia Customer Care.

Additional postage charges may be applicable.

Defective items

If there is a problem with any of the items received for your order then the Booktopia Customer Care team is ready to assist you.

For more info please visit our Help Centre.

You Can Find This Book In

Non-Fiction Computing & I.T.Computer Programming & Software Development Web Programming Computer Security Data Encryption Computer Fraud & Hacking Computer Networking & Communications Network Security

Acknowledgments	p. xiii
Introduction	p. xv
Case Study	p. xxi
J2EE Architecture and Technology Introduction
The Java Basics: Security from the Ground Up	p. 3
Java Then and Now	p. 4
Java Language Architecture	p. 5
The Java Virtual Machine	p. 5
An Interpreted Language: Java Bytecodes	p. 6
The Java Class Loader and Built-in Security	p. 6
Other Language Features	p. 7
Java Security Architecture	p. 7
Protection Domains	p. 8
Security Controls for Java Class Loading	p. 10
Java Permissions	p. 12
Java Security Policies	p. 13
The Java Security Properties File	p. 14
The Java Security Policy File	p. 15
Security Manager Checking	p. 18
Java Principals and Subjects	p. 19
Summary	p. 20
Introduction to JAAS, JCE, and JSSE	p. 21
Java Authentication and Authorization Services (JAAS)	p. 22
JAAS Architecture	p. 23
JAAS Authentication	p. 24
JAAS Authorization	p. 38
Java Encryption	p. 41
Encryption Fundamentals	p. 41
Java Cryptography Extension (JCE)	p. 43
The Keytool Utility	p. 46
Java Secure Sockets Extension (JSSE)	p. 48
SSL Fundamentals	p. 48
Library and Certificate Installation	p. 49
JSSE Demonstration Program	p. 50
Securing JAR Files	p. 56
The jarsigner Utility	p. 57
The Sealed Directive	p. 57
Summary	p. 58
J2EE Architecture and Security	p. 59
Middleware and Distributed Software Components	p. 60
Middleware Development	p. 60
Multitiered Application Development	p. 61
The Multitiered Environment	p. 62
J2EE Multitiered Technologies	p. 63
Web Tier Components: Servlets and JSP	p. 65
Servlets	p. 65
JSP	p. 69
JSP Use	p. 70
Business Tier Components: EJBs	p. 71
Services Provided by the EJB Container	p. 71
Types of EJBs	p. 73
EJB Deployment	p. 75
Development Roles with J2EE	p. 75
EJB Development	p. 78
Other J2EE APIs	p. 85
EJB Security Architecture	p. 87
Principals and Roles	p. 87
Declarative Security and Programmatic Security	p. 88
System-Level Security	p. 89
Security on the Presentation Tier	p. 89
Security on the Business Tier	p. 92
Defining Security Roles	p. 92
Mapping Roles	p. 93
Assigning Principals to Roles	p. 94
Security for Resources	p. 95
Summary	p. 97
Java Application and Network Security
Using Encryption and Authentication to Protect an Application	p. 101
Application Security: The Process	p. 102
System-level versus Application-level Security	p. 102
Application Security Techniques	p. 103
The Dangers of Storing Data Locally	p. 104
Summary	p. 134
Software Piracy and Code Licensing Schemes	p. 137
The Dangers of Code Misuse	p. 138
Another Licensing Strategy	p. 147
Secret Key Storage	p. 148
Summary	p. 156
The Exposure of Bytecodes	p. 157
The Dangers of Reverse-Engineering	p. 158
The Dangers of Embedded Strings	p. 178
Summary	p. 180
Hacking Java Client-Server Applications: Another Tier to Attack	p. 181
The Client-Server Implementation	p. 182
The Dangers of A Client-Server Architecture	p. 183
Watching the Basket: Application Database Security	p. 185
Securing the Database Connection	p. 187
Protecting the Client-Tier	p. 201
Protecting Applet-based Clients	p. 213
Protecting WebStart-based Clients	p. 227
Summary	p. 233
Java Network Applications: Potential Security Flaw Attacks	p. 235
The Dangers of RMI	p. 236
The Original RMI Application	p. 236
Encrypting the Account Number and Balance	p. 245
Using an SSL Connection between the Client and Server	p. 252
Implementing Challenge/Response Authentication	p. 257
Using an Authenticated Communications Channel	p. 260
The Dangers of Loading Class and JAR Files Remotely	p. 274
Summary	p. 276
J2EE Security on the Web and Business Tiers
This is .WAR: Exploiting Java Web Tier Components	p. 279
The Sample Application: Web-Enabled	p. 281
Implementing our Cache-Control Strategy	p. 315
Summary	p. 319
Shaking the Foundation: Web Container Strengths and Weaknesses	p. 321
The Effects of Directory Listing	p. 322
The Invoker Servlet	p. 324
Stealing a Session	p. 328
Generating a Server Key	p. 331
Enabling HTTPS in Tomcat	p. 332
Testing the Installation	p. 333
Adding a Transport Guarantee	p. 334
Client Certificate Authentication	p. 335
Configuring Tomcat to use SSL with Client Authentication	p. 336
Container Authentication Using a Client Certificate	p. 337
Dealing with Overlapping Application Roles	p. 342
Summary	p. 345
Java Web Services Security	p. 347
Web Services in Java	p. 348
Web Services Technologies	p. 349
The Web Services Developer Pack	p. 350
The Web Services-Enabled Application Implementation	p. 351
The Retirement Web Services Suite: Server Side	p. 352
The Retirement Web Services Suite: Client Side	p. 355
Web Services Application Vulnerabilities	p. 358
Requiring SSL Connections	p. 361
Implementing HTTP Authentication	p. 366
Disabling WSDL Distribution	p. 368
Enabling Programmatic Authorization	p. 370
Passing Database Passwords As Context Parameters	p. 373
Web Services Workflow Security	p. 374
The Future of Web Services Security	p. 378
SOAP Security Extensions: Digital Signature	p. 378
WS-Security	p. 379
Summary	p. 380
Enterprise Java Beans: Security for the Business Tier	p. 381
The EJB Application Implementation	p. 382
The EJB Persistence Service	p. 383
The Get and Set Balance Methods	p. 384
The Beans	p. 385
EJB Application Vulnerabilities	p. 389
Common Pitfalls When Using Message-Driven Beans	p. 400
The Message-Driven Bean Implementation	p. 401
Summary	p. 411
Index	p. 413
Table of Contents provided by Syndetics. All Rights Reserved.

Hacking Exposed

Developing Secure Web Applications with Java Technology

At a Glance

Paperback

Shipping

How to return your order

Defective items

You Can Find This Book In

More in Computer Fraud & Hacking

Cybercrime and Digital Forensics

3rd Edition - An Introduction

Hacking For Dummies

For Dummies (Computer/Tech)

Keanu Reeves is Not in Love With You

The Murky World of Online Romance Fraud

Rinsed

From Cartels to Crypto: How the Tech Industry Washes Money for the World's Deadliest Crooks

Hackers: Heroes of the Computer Revolution

25th Anniversary Edition

Minds, Memes, and Manipulation

Psychological, Cognitive and Information Warfare in the Digital Space

Cybersecurity and the Art of Cyberwar

Security, Audit and Leadership Series

Cybersecurity and the Art of Cyberwar

Security, Audit and Leadership Series

Generative AI for Cybersecurity

Minds, Memes, and Manipulation

Psychological, Cognitive and Information Warfare in the Digital Space

Privacy and Security in AI-Driven Mental Health Apps

Electric Sheep, Encrypted Dreams

A Field Guide to Defending Humanity in the Age of Neuro-Clouds, Quantum Hackers and Ethical Black Holes

Electric Sheep, Encrypted Dreams

A Field Guide to Defending Humanity in the Age of Neuro-Clouds, Quantum Hackers and Ethical Black Holes

The Deepfake Dilemma

Technology, Truth, and Forensic Integrity

Online Trust and Safety

Tools to Combat Online Harms, Misinformation and Malicious Content

Online Trust and Safety

Tools to Combat Online Harms, Misinformation and Malicious Content

Advanced Investigation Strategies for IoT Forensics

Technical Approaches to Encrypting, Security, and Investigation Strategies in IoT Forensics

Hacker's Delight

The CISO Playbook

The Adversarial Mindset

Deepfakes and the Law

Challenges, Responses, and Critique

The Art of Cyber Defense

From Risk Assessment to Threat Intelligence

Blockchain Technology for Cyber Defense, Cybersecurity, and Countermeasures

Techniques, Solutions, and Applications

Cloud Security

Concepts, Applications and Practices

Cybersecurity in Healthcare Applications

This product is categorised by