I want to be web security consultant?

Question

If I want to be very good at security and especially web security, then must I learn languages? I mean things like PHP, C#, java, etc? If not then what should I learn exactly? and do you know any good book for a beginner?

Hi @Fadi, welcome to the site! You should probably split your two questions into seperate questions (see [FAQ]), though the 2nd one re books as been asked and answered here numerous times (see [ [tag:books] ] tag). Regarding the main question, there are also several relevant questions that would be interesting to you, but are not quite duplicate - e.g. http://security.stackexchange.com/questions/3772/what-are-the-career-paths-in-the-computer-security-field. — AviD, Jun 30 '11 at 10:24

this.josh · Answer 1 · 2011-07-01T00:59:56.387

Security is a complex topic. It involves being able to understand complex systems, work with people, and solve problems with technical, social, and business solutions.

For books, I liked "CISSP All-in-One Exam Guide" by by Shon Harris. It covers the basic theory of security and many sub topics. A great history of IT Security theory can be gleaned by reading Early Computer Security Papers.

I would prefer security experts to know a broad range of relevent topics, because failure to understand a relevent domain can lead to subtle vulnerabilities. However, I was taken to task by Graham Lee, who pointed out diminishing relevance in my list of topics.

First off the three essential components of security are availability, integrity, and confidentiality. Others would add in authenticity and non-repudiation, but I would focus on the first three for someone who is just getting started.

Web security covers all the components, actors, and processes involved in web applications. The major components are the web server, the web browser, and the network connecting web browsers to web servers. The major actors are the web browser user, the web site administrator, the network administrator, and the web application creator. Note that there are typically many people filling a specific role, and there are many more roles.

I'm trying to keep specifics short, so I won't include everything. Specifics are as of this posting (mid-2011).

Web browsers

the web browser application: popularity, features, vulnerrabilities, etc
- Specifics: Internet Explorer, Firefox, Chrome
user's operating system (what the browse application runs on)
- Specifics: Windows XP, Windows Vista, Windows 7, Ubuntu Linux, Mint Linux, Fedora Linux
browser layout engines
- Specifics: Trident (Internet Explorer), Gecko (Firefox), WebKit (Chrome)
Javascript engines
- Specifics: V8 JavaScript engine (Chrome), TraceMonkey (Firefox), Chakra (Internet Explorer 9), Jscript (Internet Explorer 8)
Java virtual machines
Operating system theory: execution environment, process control, memory management, filesystems, IPC
user's network stack: IPv4, IPv6, TCP, UDP, ARP, RARP, DNS, HTTP, HTTPS, FTP, WebDAV
user's network connection: ethernet (IEE 802.3), WiFi (IEE 802.11),
cryptography: symetric key cryptography, public key cryptography, certificates, certificate revocation lists, Certificate Authorities, and hashing.
- miscellaneous: black lists, white lists, sandboxing, downloading, password management, caching, and updating.

Network

network hardware: router, switch, bridge, hub, firewall, proxy, Network Attacked Storage (NAS), Wireless Access Point, SIP servers, VPN servers
network protocols: ethernet (IEE 802.3), TCP, UDP, IPv4, IPv6, IPSec, IGMP, WiFi, ARP/RARP, ICMP, IGMP, BGP, RIP, SNMP, SMB, DNS, DHCP, FTP, HTTP, LDAP, MIME, NetBIOS, POP3, RADIUS, SSH, SIP, SMTP, SOAP, WebDAV)
network configuration and architecture

Web server

http servers
- Specifics: Apache, Microsoft IIS Windows Web Server, nginx, Google Web Server, lighttpd
operating systems (what the http server runs on)
- Specifics: Windows Server 2008, Windows Server 2003, Windows XP Professional, RedHat/CentOS, Ubuntu/Debian, SuSE/openSuSE
programming languages (used to write http servers, operating system, frameworks, etc)
- Specifics: C (Apache), C++ (IIS), Java, JavaScript, PHP, C#, Python, Perl
business impacts (usability, updates, changes, software life cycle, user avoidance and circumvention, user education)
databases (relational, objet oriented, architecture, distributed, transactional, SQL, management, security)
- Specifics: MySQL, Oracle, Microsoft SQL, PostgreSQL
cryptography (symetric encryption, public key encryption, hashing, random number generation, salts, digital signatures, HMAC, AES modes of operation, initialization vectors, key generation, key distribution, key revocation, certificates)
network (firewall rules, DMZ architecture, proxys, load balancing, Single Sign-On authentication passing)
server management (user accounts, patches, upgrades, logging, log review, Intrusion Detection Systems [IDS])

Communication

In my opinion a good consultant (of any kind) is an effective communicator.

Technical design presentations and reviews
Solution pitches
Business case reviews
Whitepapers
User education presentations

Other nice to have areas:

computer hardware architecture (CPU, RAM, Disk drives, video displays)
peripheral busses (USB, FireWire, RS-232, I^2C, PCI, SATA, SCSI, Bluetooth)
CPU architecture (operating states [protected mode], I/O bus, registers, MMU, TLB, pipelines, and interrupts)
operating systems theory (kernel types [Monolithic, Microkernel], drivers, memory management, file systems, process control, threads, scheduling)
programming language theory (interpreters, compilers, machine language, symbol tables, dynamic libraries, dynamic linking)
executable file formats (ELF, PE, COFF, a.out)
database theory (relational, objet oriented, architecture, distributed, transactional, SQL, management, security)
file systems (fat32, NTFS, ext2, ext3, linux swap)

-1 I disagree that you need to know the entire of computing in order to do security well. Indeed, many companies don't have _anyone_ covering all of those fields you name (when was the last time salesforce.com needed to know about a.out binaries?) and yet still do just fine. You could have reduced that list down to "1. some stuff. 2. How to make use of other people's results." — , Jun 30 '11 at 08:36
@Graham-Lee Good criticism, I'll make some revisioms. However, the OP did say 'web security consultant' which to me means you have to be very knowlegeable in a wide range of topic. For your point 2. making use of other people results, I see people who do not really understand the results attempt to apply them blindly and incorrectly. I reviewed a design from a senior engineer at a very large firm who wanted to add checksums to messages sent by TCP. If he knew his networking he would have known that TCP already has checksums built in. — this.josh, Jun 30 '11 at 16:44
And if he knew "how to make use of other people's results" he would have known how to find out that this was already done. As it was, he didn't, and invented it himself. Exactly my point. — , Jun 30 '11 at 17:46

score 6 · Answer 2 · answered Jun 30 '11 at 04:47

It depends on what 'good at security' and 'good at web security' means to you.

If you want to help people find flaws in their work, then you'll want to know the languages they use at least on a level comparable to theirs (though presumably with a different focus)

If you want to analyze systems, then you'll want to learn how systems interact (again from a security perspective). In this case the specific languages don't matter as much as the details of the interactions (APIs / protocols)

As far as 'a good book', I would recommend reading as wide a variety of books / documents as you can. IMHO 'good' security comes from experience / breadth and depth of knowledge. If there is a book that you think might impact on something you're interested in, read it. Even if you only skip to the 'good bits', having another viewpoint will have benefit.

I personally would suggest reading things by Dan Kaminsky and Bruce Schneier for mind-opening takes on security. Mr. Schneier is probably a bit easier of a read, while Mr. Kaminsky has deep knowledge and sometimes breaks my head. I like to think of security from a systems perspective, so this selection might show a little of my bias (notably neither of the above authors has a strong focus on 'web security' per-se.)

+1, I would also add that for blackbox breaking you don't need either of the above, rather an excellent knowledge of HTTP and common web attacks (and a little bit more...) — AviD, Jul 05 '11 at 00:02

score 3 · Answer 3 · answered Jun 30 '11 at 01:31

A great book for a beginner are the Security+ preparation books as they provide a great, broad discussion of many different topics in the security field.

As far as a language is concerned a great security professional knows a vast majority of languages as it allows them to react to different needs. If it is your first language, I would recommend C++ and then later Python. There is a fabulous book on Python and its use in security titled, Gray Hat Python: Python Programming for Hackers and Reverse Engineers. I might also recommend the CEH test book and the CCNA test prep. These are a few books I couldn't go without.

Hope this helps.

score 2 · Answer 4 · edited Jun 16 '20 at 09:49

This looks promising: http://mdsec.net/

"Online training labs from the authors of The Web Application Hacker's Handbook"

"Do the online labs contain learning materials such as slides, videos, solutions or other training documentation?"
"No, at the present time we only provide self-service labs demonstrating numerous types of security vulnerabilities. We recommend that you work through the labs while reading The Web Application Hacker's Handbook as a study aid. In future, we may offer additional learning materials on a subscription basis."

score 2 · Answer 5 · answered Sep 21 '11 at 07:15

You have to learn how to build web applications before you can become "very good" at web security. That means you need to know how to build LAMP (Linux Apache MySQL PHP) applications. That means writing not only PHP code, by SQL query statements.

But you can't stop there. You also need to build ASP pages on top of Microsoft SQL.

But that's just the server side. Hacking the web is also about attacking browsers. You need to learn how to play with JavaScript to manipulate the DOM, and make XML queries to the server application.

Once you know how to build these things, you'll have the knowledge to secure/hack them.

Todd Grotenhuis · Answer 6 · 2012-02-03T01:27:06.217

To be very good, you will need to invest some time in web languages. You can do many things, without, however.

I would suggest that you become able to read HTML, JavaScript, PHP, Java, Python, C#, and Ruby, at least at a high level. Choose at least one (in addition to HTML) to be able to write. Not only will it help with your understanding of web applications, but it will help you to automate your work, change application code, and script exploits & reports.

As to your book question, it's unclear whether you mean for programming, or for security. If security, there are excellent free resources available at the Open Web Application Security Project (OWASP). See the Development Guide, Code Review Guide, and Testing Guide. These are available digitally (for free) or print-on-demand through Lulu.

I want to be web security consultant?

6 Answers6

Linked