Hack

LESSON 10 WEB SECURITY AND PRIVACY

LESSON 10 – WEB SECURITY AND PRIVACY

“License for Use” Information
The following lessons and workbooks are open and publicly available under the following terms and conditions of ISECOM: All works in the Hacker Highschool project are provided for non-commercial use with elementary school students, junior high school students, and high schoolstudents whether in a public institution, private institution, or a part of home-schooling. These materials may not be reproduced for sale in any form. The provision of any class, course, training, or camp with these materials for which a fee is charged is expressly forbidden without a license including college classes, university classes, trade-school classes, summer or computer camps, andsimilar. To purchase a license, visit the LICENSE section of the Hacker Highschool web page at www.hackerhighschool.org/license. The HHS Project is a learning tool and as with any learning tool, the instruction is the influence of the instructor and not the tool. ISECOM cannot accept responsibility for how any information herein is applied or abused. The HHS Project is an open community effortand if you find value in this project, we do ask you support us through the purchase of a license, a donation, or sponsorship. All works copyright ISECOM, 2004.

2

LESSON 10 – WEB SECURITY AND PRIVACY

Table of Contents
“License for Use” Information............................................................................................................... 1Contributors..............................................................................................................................................1 10.1 Fundamentals of Web Security..................................................................................................... 1 10.1.1 How the web reallyworks.......................................................................................................1 10.1.2 Rattling the Locks....................................................................................................................1 10.1.3 Looking through Tinted Windows - SSL................................................................................. 1 10.1.4 Having someone else do it for you –Proxies....................................................................... 1 10.2 Web Vulnerabilities..........................................................................................................................1 10.2.1 Scripting Languages................................................................................................................1 10.2.2 Common Web ApplicationProblems................................................................................... 1 10.2.3 Guidelines for Building Secure Web Applications................................................................1 10.3 HTML Basics – A brief introduction................................................................................................1 10.3.1 ReadingHTML...........................................................................................................................1 10.3.2 Viewing HTML at its Source.....................................................................................................1 10.3.3 Links ..........................................................................................................................................1 10.3.4 Proxy methods for Web ApplicationManipulation............................................................. 1 10.4 Protecting your server.....................................................................................................................1 10.4.1 Firewall.......................................................................................................................................1 10.4.2 Intrusion Detection System...