黑客攻防技术宝典：Web 实战篇
The web application hacker's handbook
Dafydd Stuttard、Marcus Pinto · 初版 2007 年
31人推荐
48位读者提及
63次提及
为什么值得读
- 公认学习Web应用安全实战的首选入门书
- 内容兼顾实用性，适合边动手实践边学习
- 是参与漏洞赏金计划与白帽黑客的必备基石
本书是一本关于发现并利用 web applications 中安全漏洞的实用指南。作者结合现实范例、截图和代码片段，深入讲解了各类漏洞。全书高度注重实战，详细描述了在网上银行、电子商务等各类 web applications 中检测和利用各种安全缺陷的具体步骤。涵盖的主题包括绕过登录机制、代码注入、利用逻辑缺陷以及侵害其他用户。因为每一个 web app
Hacker News 上怎么说
正在加载完整评论……
这单子上的书我大部分都读过。下面带大家快速过一遍哪些绝对有用、哪些最好避坑。_________________ 必读书目：1. 《黑客攻防技术宝典：Web实战篇》（The Web Application Hacker's Handbook）——虽然有点显老了，但要是想学实用的应用安全，这绝对依然是我首推给所有人的第一本书。2. 《实用逆向工程》（Practical Reverse Engineering）——没错，这本超棒。至于……
So, I've read most of these. Here's a tour of what is definitely useful and what you should probably avoid. _________________ Do Read: 1. The Web Application Hacker's Handbook - It's beginning to show its age, but this is still absolutely the first book I'd point anyone to for learning practical application security. 2. Practical Reverse Engineering - Yep, this is great. As…
……根本不需要考任何证书。1. 学习写代码。入门首选C + Python（或者C + Ruby）。2. 从应用安全入手，因为这是最容易上手入坑的方向。3. 把《黑客攻防技术宝典：Web实战篇》彻彻底底啃下来（别光看不练）。4. 尽可能多去BugCrowd或HackerOne上的项目里挖bug bounty。要是能挖到Google、Facebook等大厂的漏洞，简历绝对大加分（还能赚到真金白银！）。5. 加入一家靠谱的安全……
…certifications at all. 1. Learn to code. C + Python is a great choice, to start with (or C + Ruby). 2. Start with application security, because it's the easiest place to get your feet wet. 3. Work through The Web Application Hacker's Handbook (don't just read it). 4. Find bug bounties in as many programs on BugCrowd or HackerOne as you can. Extra resume points (and money!) for bug bounties in Google, Facebook etc. 5. Join a reputable security…
一份质量平平、东拼西凑的速查表（cheat sheet），里面的例子往往针对性太窄。不如去翻翻《黑客攻防技术宝典：Web实战篇》，或者去读OWASP Testing Guide。
A mediocre, haphazardly put together cheat sheet with often application-specific examples. Pick up The Web Application Hacker's Handbook instead, or read the OWASP Testing Guide.
我同意。想成为一名技术全面的黑客，我强烈推荐这几本书：* 《TCP/IP详解》（卷1、2、3）——W. Richard Stevens * 《黑客攻防技术宝典：Web实战篇》——Stuttard, Pinto 等著 * 《Shellcoder编程揭秘》（The Shellcoder's Handbook）——Koziol, Aitel 等著 * 《杜鹃蛋》（The Cuckoo's Egg）——Clifford Stoll * 《神经漫游者》（Neuromancer）——William Gibson * 《ARM片上系统体系结构》（ARM System-on-chip Architecture）——Stephen B. Furber *……
I would agree. Some of the books I'd highly recommend for anyone looking to be a well-rounded hacker: * TCP/IP Illiustrated (Volumes 1,2 & 3) - W. Richard Stephens * The Web Application Hacker's Handbook - Stuttard, Pinto et al * The Shellcoder's Handbook - Kozoil, Aitel et al * The Cuckoo's Egg - Clifford Stoll * Neuromancer - William Gibson * ARM System-on-chip Architecture - Stephen B. Furber *…
……绝对是名至实归。对于想尝试赚这种赏金的朋友，我还是老调重弹推荐那几本书：1. 《软件安全评估的艺术》（The Art of Software Security Assessment） 2. 《白帽子讲Web安全 / Gray Hat Python》 3. 《黑客攻防技术宝典：Web实战篇》（The Web Application Hacker's Handbook）。这就是你的道德黑客新手包。前两本适合打基础，教你挖值钱的bug；第三本专门针对Web应用，……
…are well deserved. For those of you who would like to try and earn bounties like these, I recommend the same books I always do: 1. The Art of Software Security Assessment 2. Gray Hat Python 3. The Web Application Hacker's Handbook This is your ethical hacker starter kit. The first two are good for foundational knowledge and will show you how to find the bugs worth something. The third book is specialized for web applications,…
我很喜欢Dafydd Stuttard写的《黑客攻防技术宝典：Web实战篇》，尽管书名起得有点中二。一定要把书里的动手做一遍。很多人会推荐你去看OWASP，作为免费的三手资料（owasp.org）确实还不错，上面有很多HOWTO教程。不过要小心……
I like Dafydd Stuttard's "The Web Application Hacker's Handbook", despite the title. Work through the examples. A lot of people will direct you to OWASP, which is not a bad free tertiary source (owasp.org). There's lots of HOWTO stuff there. Be careful about the…