Foreword xiii
Preface xvii
Acknowledgments xxix
About the Authors xxxi

Part i: Introduction
Chapter 1: Case Your Own Joint: A Paradigm Shift from Traditional Software Testing 3
Chapter 2: How Vulnerabilities Get Into All Software 19
Chapter 3: The Secure Software Development Lifecycle 55
Chapter 4: Risk-Based Security Testing: Prioritizing Security Testing with Threat Modeling 73
Chapter 5: Shades of Analysis: White, Gray, and Black Box Testing 93

Part Ii: Performing the Attacks
Chapter 6: Generic Network Fault Injection 107
Chapter 7: Web Applications: Session Attacks 125
Chapter 8: Web Applications: Common Issues 141
Chapter 9: Web Proxies: Using WebScarab 169
Chapter 10: Implementing a Custom Fuzz Utility 185
Chapter 11: Local Fault Injection 201

Part IIi: Analysis
Chapter 12: Determining Exploitability 233

Index 251