I've been looking to learn how to secure web apps more systematically. Just thinngs that (should be) well-understood by now--logins, customer data security, how to take payments with or without storing credit card info (even if that's just using a third-party processor). I've found the OWASP site, which seems poorly maintained and terribly organized, and a bunch of books that focus on how to pentest existing apps. The books that focus systematically on security, like Security Engineering, are extremely general and don't explicitly cover the webapp use case.
https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje...
Troy Hunt has some good advice on his blog and a site for checking for issues:
I like using ASVS as a checklist when doing a webapp pentest:
https://www.owasp.org/index.php/Category:OWASP_Application_S...
The OWASP testing guide is an incredibly verbose walkthrough for finding most types of web vulns:
https://www.owasp.org/index.php/Category:OWASP_Testing_Proje...
Some of the cheat sheets are ok, but many are littered with incorrect and incomplete info, so take them with a grain of salt:
https://www.owasp.org/index.php/Cheat_Sheets
All that said, I think that most (all?) professional web security testers use Burp Suite and have a copy of The Web Application Hacker's Handbook (2nd) on their desk. The book's authors wrote an on-demand assault course to help learn the concepts in the book and it is pretty decent. About $200 and you'll get most of the way through it. A few people I've known that went through it gave it good reviews.
I think the second book most web security testers have on their desk is The Tangled Web by Michal Zalewski (of afl-fuzz and ratproxy fame). If you have a chance, reading the ratproxy source can be an informative way to learn how a web scanner is built and about the vulns it can find:
http://www.amazon.com/The-Tangled-Web-Securing-Applications/...
https://code.google.com/p/ratproxy/
Finally, the last and probably best way to learn web security is to play in a CTF. These are time-compressed challenges that last 24-72 hours where teams of competitors hack purposefully vulnerable applications to score points. Here's a calendar of upcoming competitions and a little guide I wrote about them:
https://trailofbits.github.io/ctf/
EDIT: Ah, I realize I wrote this from the perspective of learning to break web applications and included few development resources. While some of that knowledge is generic (password storage, for instance), much of that knowledge is framework-specific. For example, see the Rails security guide and brakeman:
The Tangled Web is a good primer on browser security, which is a deeper topic.
The OWASP Top 10 is worth knowing because it's a widely recognized metric, but OWASP itself is not an especially great resource.
The Tangled Web is better for learning the underlying causes of various issues presented in the former book and for learning how to prevent them. It has excellent, practical checklists at the end of every chapter for anyone building an application.
Burp is the industry standard. It's also a criminally underrated dev tool. If you're getting paid to build web applications, you should own a license.
Similarly, the online stuff is totally optional, and none of the master WAHH crafstmen I know have needed that in the slightest.
It is pretty clear in reading those reviews that a person can, with no investment of time or effort, write bad reviews about anything.
It takes effort and energy to get the most out of WAHH, and you can do it without spending an additional dime.
If you are too cheap to spend $7 an hour, you can set up a vulnerable VM and accomplish the same thing for free.
https://github.com/paragonie/awesome-appsec
Our blog also have a bunch of posts about building secure web applications in PHP:
https://paragonie.com/blog/category/security-engineering
I hope either one helps.
Unattended upgrades are a good start for your OS-managed dependencies, but make sure to keep up with your app-managed dependencies. You could setup a continuous-integration thing that runs your tests against the latest minor versions of all of your dependencies and upgrades when deemed safe, though you need excellent test coverage to get away with it.
Anyone know of great resources for managing your deployments and dependencies? Something other than "here's how we use docker."
Related plug: There is https://appcanary.com/ which is a dependency vulnerability alerting service (disclaimer: I'm friends with the founders, swell folks who genuinely care about improving the safety of code everywhere). Many vulnerability databases are public, but keeping track of things—especially across platforms and database providers—is really painful.
Write a web app. Find the least friendly, most bare bones server in whatever your favorite language is (sinatra, flask, gin-gonic). Write as much of the MVC stuff as you can yourself. You will unintentionally implement at least one of the OWASP top 10 bugs. Maybe try to intentionally implement as many of them as you can.
So far the most educational coding I've done is writing a web proxy and a web router. Pentesting forced me to look at most parts of an HTTP request... rewriting headers, implementing session stores and (trying to) handle SSL has all been painfully educational.
The second most common issue I see is XSS vectors, and for that, you just have to get down and learn about all the features (and edge cases) that javascript/HTML5 has. For instance, things like not storing sensitive data in localStorage.
Being clever at XSS/CSRF is what forced me to learn javascript in the first place. Also worth writing your own instead of using existing stuff like jquery.
Personally I think I'm too dumb to implement all that stuff by hand without screwing something up.
Nikto, and other free web app vulnerability scanners can be good for both learning and practical use in the real world (albeit not much more useful than low-hanging fruit). http://sectools.org/tag/web-scanners/
"a purposefully vulnerable Django application. comes with a series of writeups for the vulnerabilities we've added to the code. Each tutorial comes with a description of the vuln, a hint to where to find it, and then the exact bug and how it could be remedied."
"You can access these tutorials within the app at http://localhost:8000/taskManager/tutorials/, or by clicking on the 'Tutorials' link in the top-right of the web interface."
Check out the AppSec conference videos (https://www.owasp.org/index.php/Category:OWASP_Video). You can find useful talks for "defenders" and "builders" there. For example, one of the first videos on their Vimeo channel (https://vimeo.com/appsecusa) is a talk by Douglas Crockford about securing JavaScript.
One of the biggest problems with the security information out there is that it's mostly geared towards "breakers" (and to a lesser degree "defenders"), but to change the state of security we need more (quality) information for "builders", so they can build more secure apps...
By the way, if you are a web app builder and you care about security learn and use CSP (Content Security Policy). CSP is one of the most effective ways to deal with the XSS attacks. Here's a place to get started: https://developer.mozilla.org/en-US/docs/Web/Security/CSP/In...
Definitely read that to get a holistic image.
The episode archive has a whole course on security,with a focus on the web
Would I hire him to do pentesting on my app? No.
Would I enjoy listening to him talk on a podcast about security related topics. Sure, I do.
If a junior developer logs an issue stating "I'm concerned that this function could lead to SQL injection", what is the reaction?
In most companies I've seen, the answer is a senior developer saying either "show me an exploit or accept that you're wrong". If the attitude was instead to say "I disagree about exploitability, but the fact there's a question there is a code smell regardless so send a PR", a lot of vulnerabilities would go away.
That way, everything is built in.
Knowledge comes before tooling (IMO).
