软件安全评估的艺术
The art of software security assessment
Mark Dowd、John McDonald、Justin Schuh · 初版 2006 年
21人推荐
31位读者提及
43次提及
为什么值得读
- 被誉为安全行业的权威圣经，核心原理历久弥新
- 极其详尽地指导源代码安全审查与审计技能
- 适合作为漏洞挖掘与道德黑客入门的底层基石
Hacker News 上怎么说
正在加载完整评论……
The art of software security assessment
Mark Dowd、John McDonald、Justin Schuh · 初版 2006 年
正在加载完整评论……
……而不是仅仅看一本针对某个特定平台（比如 iOS）的书。可以搭配一本专门讲工具的书，比如《The IDA Pro Book》。3. 《Security Engineering》——你读这本或者《The Art of Software Security Assessment》都行。这两本虽然都是老书了，但核心原则永不过时。你绝对应该读其中一本，因为它们就像安全领域的《计算机程序设计艺术》（TAOCP）。每个人都说自己读过……
…instead of just a platform-specific book targeted to something like iOS. Maybe supplement with a tool-specific book like The IDA Pro Book. 3. Security Engineering - You can probably read either this or The Art of Software Security Assessment. Both of these are old books, but the core principles are timeless. You absolutely should read one of these, because they are like The Art of Computer Programming for security. Everyone says they have…
……看到类似的漏洞报告在 HN 上越来越主流，这些赏金真是实至名归。对于想尝试靠挖洞赚这种赏金的朋友，我还是老生常谈推荐这几本书：1. 《The Art of Software Security Assessment》 2. 《Gray Hat Python》 3. 《The Web Application Hacker's Handbook》。这就是你的白帽黑客入门全家桶。前两本很适合打牢基础，教你挖到真正值钱的 bug。……
…like this enter the mainstream more and more on HN. These bounties are well deserved. For those of you who would like to try and earn bounties like these, I recommend the same books I always do: 1. The Art of Software Security Assessment 2. Gray Hat Python 3. The Web Application Hacker's Handbook This is your ethical hacker starter kit. The first two are good for foundational knowledge and will show you how to find the bugs worth something.…
……http://www.leshatton.org/MISRA_comp_1105.html http://www.leshatton.org/ISOC_subset1103.html http://www.embedded.com/electronics-blogs/embedded-systems-d... 关于安全代码这个相关话题，这几本书很不错：Mark Dowd，2006，《The Art of Software Security Assessment》。Robert Seacord，2013，《C and C++ 安全编码（第 2 版）》。至于想深入探究 C 语言底层到底在干嘛：Paul Anderson，1998，《Advanced C: Tips and Techniques》。Kenneth Louden，1997，《编译原理及实践》：……
…http://www.leshatton.org/MISRA_comp_1105.html http://www.leshatton.org/ISOC_subset1103.html http://www.embedded.com/electronics-blogs/embedded-systems-d... For the related topic of secure code, these books are good: Mark Dowd. 2006. The Art of Software Security Assessment. Robert Seacord. 2013. Secure Coding in C and C++, 2e. For details on what is really going on inside C: Paul Anderson. 1998. Advanced C: Tips and Techniques. Kenneth Louden. 1997. Compiler Construction:…
……为搞懂各类漏洞打下坚实的基础。2. 《The Mobile Application Hacker's Handbook》，作为第 1 本书在应用安全方面的极佳补充，重点显然在移动端 app 上。3. 《The Art of Software Security Assessment》，安全行业的圣经。对做源码审计尤其具有指导意义。4. 《Security Engineering》（Ross Anderson 著），作为第 3 本的补充。在把安全融入整个 SDLC（软件开发生命周期）方面非常有指导意义……
…strong foundation for the different classes of vulnerabilities. 2. The Mobile Application Hacker's Handbook Good supplement to #1 for application security, obviously focused on mobile apps. 3. The Art of Software Security Assessment The bible of the security industry. Especially instructive for source code review. 4. Security Engineering (Ron Anderson) Supplements #3. Very instructive for injecting security into the overall SDLC…
……想学逆向工程。先从《Hacking: The Art of Exploitation》起步，然后进阶到《Reversing: Secrets of Reverse Engineering》或《Practical Reverse Engineering》。同时你还得读一读《The Art of Software Security Assessment》和《Security Engineering》，以此培养扎实的代码审计和二进制渗透测试能力。说实话，不管你在安全圈干哪一行，这两本书都应该读一读。5. 很多……
…want to learn reverse engineering. Start with Hacking: The Art of Exploitation and then proceed to Reversing: Secrets of Reverse Engineering or Practical Reverse Engineering. You'll also want to read The Art of Software Security Assessment and Security Engineering alongside those, to develop excellent source code auditing and binary penetration testing skills. Frankly you should read those no matter what you do in security. 5. It's very…
《The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities》 http://www.amazon.com/The-Software-Security-Assessment-Vulne...
The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities http://www.amazon.com/The-Software-Security-Assessment-Vulne...