Application Security Resources

The majority of links on this page are external web sites and links not maintained by Security PS. In addition, some of the links are in PDF format and require Adobe Acrobat Reader.

Web Application Security Information Sites

• Open Web Application Security Project (OWASP)
• CGI Security.com
• MSDN: Microsoft® Security Developer Center
• SQL Security.com
• MIT LCS:The Cookie Eaters

Web Application Security Documents and Articles

• OWASP: Guide to Building Secure Web Applications and Web Services
• Best Practices for Secure Development, by Razvan Peteanu (PDF)
• Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication
• Microsoft Article: Cross-Site Scripting Explained
• .Net Security Policy Best Practices
• J2EE Security
• CGI-Security: Cross Site Scripting FAQ
• Secure a Web Application, Java Style
• Developer.com Article: JSP Security
• @Stake: Secure Business Quarterly, 2nd Quarter 2002
• Dos and Don'ts of Client Authentication on the Web
• WWW Authentication, by Kurt Seifried
• Predictable Session ID's
• Web Cookies: Not Just a Privacy Risk, by Emil Sit and Kevin Fu
• CERT: Understanding Malicious Content Mitigation
• W3C: The WWW Security FAQ

Web Application Security Mailing Lists

• SecurityFocus WebAppSec Mailing List

General Application Security, Secure Coding Concepts

• Microsoft's Secure Development Articles/Resources
• Secure Coding, by David Wong
• HOWTO: Secure Programming for Linux and Unix (Other Formats)
• Perl Security
• Java: Security Code Guidelines
• Architectural Pattern for Enabling Application Security, by Joseph Yoder (PDF)
• Paper: Smashing The Stack For Fun And Profit, by Aleph One
• Paper: Exploiting Format String Vulnerabilities