Book
Web Security Tantosha no Tame no Zeijakusei Shindan Start Guide, 2nd Edition (A Vulnerability Assessment Start Guide for Web Security Staff)
Sen Ueno Teaches New Techniques for Preventing Information Leaks
Sen Ueno
Summary
A Japanese-language guide to vulnerability assessment for web security staff, in its 2nd edition, by Sen Ueno, the representative of OWASP Japan. The 2nd edition revises the content along the lines of the OWASP Top 10 2017, with an explanation of the revised guidelines, descriptions of the added vulnerabilities, a review of the points to inspect, and support for the latest versions of the assessment tools. The first half covers the network knowledge needed for assessment, such as how web applications communicate and what vulnerabilities are. The second half uses BadStore, a web application with real problems, on a virtual machine, to learn assessment methods hands- on: automatic assessment with OWASP ZAP, and manual assessment with Burp Suite by inserting test patterns into parameters such as forms. A set of vulnerability assessment guidelines is also included.
Target Readers
- Web application developers and security staff
- Engineers who want to assess and verify vulnerabilities in applications they developed themselves, and developers who want to learn how to use DAST tools in practice
- Business executives, as well as web application developers
Tags
Colophon
- Publisher
- Shoeisha
- ISBN
- 978-4-7981-5916-4
- Published
- Feb 2019
- List price
- ¥3,608incl. taxMay differ from the actual selling price on Amazon
Get this book
* The link above is an advertisement via Amazon Associates.Related Books
Prerequisites
- Recommended
Taikeiteki ni Manabu Anzen na Web Application no Tsukurikata, 2nd Edition (A Systematic Guide to Building Secure Web Applications)
How Vulnerabilities Arise and How to Counter Them in Practice
Hiroshi Tokumaru
Reason: After learning the principles of vulnerabilities, verify them with your own hands. Dynamic analysis with OWASP ZAP and Burp Suite lets you feel how attacks you knew only in theory actually succeed in real traffic, closing the gap between theory and practice.
- Related
Designing Secure Software
A Guide for Developers
Loren Kohnfelder
Reason: Once threat modeling has surfaced 'where the risks lie' at design time, confirm those assumptions through hands-on assessment. Matching design-level threats against actual behavior validates the effectiveness of your defenses.
Next Books
- Related
Seisei AI no Anzensei Nyumon (An Introduction to Generative AI Safety)
Koki Wataoka
Reason: After gaining hands-on diagnostic experience with tools like OWASP ZAP and Burp Suite that closes the gap between theory and practice, turn that same posture — verifying defenses in the field — toward a new target. Generative-AI risk is evaluated through a different form, benchmarks and red-teaming, but the idea of backing up desk assumptions with verification carries over.