The tangled Web
by Michal Zalewski · first published 2011
84% recommend16% neutral
Why HN recommends it
Explains why browser and web app security is so messy, tracing quirks like content sniffing and URL parsing, with per-chapter cheat sheets. Pairs well with Web Application Hacker's Handbook for developers and testers.
Summarised by Claude from recommending comments
"'Thorough and comprehensive coverage from one of the foremost experts in browser security.' --Tavis Ormandy, Google Inc. Modern web applications are built on a tangle of technologies that have been developed over time and then haphazardly pieced together. Every piece of the web application stack, from HTTP requests to browser-side scripts, comes with important yet subtle security consequences. To keep users safe, it is essential for developers to confidently navigate this landscape.In The Tangled Web, Michal Zalewski, one of the world's top browser security experts, offers a compelling narra
Affiliate links. As an Amazon Associate I earn from qualifying purchases.
Mentions per year
What Hacker News says
Related books
2013–2017A tangled web
Lucy Maud Montgomery
Recommended by 2 · mentioned by 22 recommend · 2 mention2 recommend · 22 recommend
2009–2023The web application hacker's handbook
Dafydd Stuttard, Marcus Pinto
Recommended by 31 · mentioned by 4831 recommend · 48 mention31 recommend · 4831 recommend
2008–2026Silence on the Wire
Michal Zalewski
Recommended by 29 · mentioned by 3829 recommend · 38 mention29 recommend · 3829 recommend
2009–2017Gray hat Python
Justin Seitz
Recommended by 5 · mentioned by 85 recommend · 8 mention5 recommend · 85 recommend
2013–2017The IDA Pro book
Chris Eagle
Recommended by 5 · mentioned by 75 recommend · 7 mention5 recommend · 75 recommend
2008–2025The art of software security assessment
Mark Dowd, John McDonald, Justin Schuh
Recommended by 21 · mentioned by 3121 recommend · 31 mention21 recommend · 3121 recommend
2016–2024Practical Reverse Engineering
Bruce Dang, Alexandre Gazet, Elias Bachaalany
Recommended by 6 · mentioned by 86 recommend · 8 mention6 recommend · 86 recommend
…one will take you about as far as any book reasonably can; beyond that you'll need to practice and read walkthroughs from e.g. The Project Zero team and HackerOne Internet Bug Bounty reports. 5. The Tangled Web - Written by Michal Zalewski, Director of Security at Google and author of afl-fuzz. This is the book to read alongside The Web Application Hacker's Handbook. Unlike many of the other books listed here…
on “Cybersecurity Humble Book Bundle” ↗If you don't know who this is, he wrote one of my favourite books on web (browser) security: "The Tangled Web" [1]. Another lesser known book by him is also worth a read: "Silence on the Wire" that takes a look at the full information security stack from the keyboard you type on, to the wires the data transits,…
on “Michał Zalewski, Director Information Security Engineering, leaves Google” ↗Interesting idea. Try get people who are considering selling exploits to get a little money from Google instead. Michal Zalewski (lcamtuf) is highly respected in the security world - The Tangled Web and Silence on the Wire are excellent reads. It would be very surprising if this didn't lead to a few new BIND and ISC DHCPD bugs coming out in the near future.
on “Going beyond vulnerability rewards” ↗…Internet simply ended up having to swallow far more than it was designed to handle. The dot-com boom paved the way for it becoming essential and inseparable to our livelihoods. Michal Zalewski's The Tangled Web is an excellent technical book on how the technologies that power the web are interconnected, and how they're all a vulnerable mess of hacks. On the surface, it looks like everything is running smoothly,…
on “The Curse of the Internet” ↗More web app madness. The main lesson I took from Michal Zalewski's excellent book "The Tangled Web" was I hope I never have to write a web application. There are far too many traps.
on “The Performance Cost of CORS Requests on Single-Page Applications” ↗I love WAHH. I can't stand "Deadly Sins". I'd replace it with _The Tangled Web_, Zalewski's new web security book; WAHH and _Tangled_ is a formidable amount of knowledge to keep on tap.
on “What should every programmer know about security?” ↗…tends to have pretty reasonable coverage of "the big three" web flaws --- XSS, CSRF, and SQLI. If you're a professional, my recommendation is to buy Daffyd Studdart's book, and Michel Zalewski's "The Tangled Web".
on “OWASP Testing Guide 2014” ↗…you'll get most of the way through it. A few people I've known that went through it gave it good reviews. http://mdsec.net/ I think the second book most web security testers have on their desk is The Tangled Web by Michal Zalewski (of afl-fuzz and ratproxy fame). If you have a chance, reading the ratproxy source can be an informative way to learn how a web scanner is built and about the vulns it can find: http://www.amazon.com/The-Tangled-Web-Securing-Applications/...…
on “Ask HN: Best resources on webapp security?” ↗…recommendations: - follow smart security people on Twitter, which is the defacto medium for information security discussion - read publicly disclosed bug bounty reports on Hackerone and Bugcrowd - read The Tangled Web by Michal Zalewski - learn to use Burp Suite
on “Ask HN: What are the best resources for learning security and pen testing?” ↗…applications is that they are highly complex and they involve browsers. Browsers are extraordinarily complex programs working to a set of conflicting, evolving standards. For illustration, I suggest reading The Tangled Web by Zalewski. (But read it early in the day--reading late at night might lead to nervous or disturbed sleep.) Or his blog post "Postcards from the post-XSS world": http://lcamtuf.coredump.cx/postxss/.…
on “Ask HN: Why do you think vulnerable code is still being released today?” ↗I think you would enjoy the book _The Tangled Web_ by Michel Zalewski, of Google's browser & web security team.
on “#1 CSRF Is A Vulnerability In All Browsers” ↗Some blogs I like (most are not updated very frequently, though): Billy Rios (discovered GIFAR) http://xs-sniper.com/blog/ Michal Zalewski (one of the top security researchers in the world, wrote "The Tangled Web", a must-read) http://lcamtuf.blogspot.com Neal Poole: https://nealpoole.com/blog/ Nir Goldshlager: http://www.nirgoldshlager.com/ Michael Brooks: https://sitewatch.me/en/Blog Nils Jünemann: http://www.nilsjuenemann.de/…
on “How we hacked Facebook with OAuth2 and Chrome bugs” ↗I'd also like to know Security 101 for web developers. In a recent appsec thread, there were two books that a lot of people recommended: http://www.amazon.com/The-Tangled-Web-Securing-Applications/... http://www.amazon.com/The-Web-Application-Hackers-Handbook/d... https://news.ycombinator.com/item?id=5862102
on “Ask HN: the best(s) web security book for web developers” ↗The Tangled Web is written by Michal Zalewski. The book is the updated version of the famous Browser Handbook. [1] I still recommend looking at it if you can't get The Tangled Web. IMO, this is the bible of web security…
on “Recommended Security Reading” ↗…résumé, check out Michal Zalewski's - it's on his website. He is also responsible for American Fuzzy Lop, which is an incredible fuzzing tool for application software[1]. In fact, read his book, The Tangled Web as well, because that should be on every developer's shelf, security engineer or otherwise. It has security best practice checklists covering how the internet and browser works with enough technical detail…
on “EFF’s Game Plan for Ending Global Mass Surveillance” ↗