The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

functions. The most common behaviors are: (a) the application creates a

new session any time a request is received that does not submit a token,

and (b) the application creates a new session following a successful

login. In order to harvest large numbers of tokens in an automated way,

ideally identify a single request (typically either 

GET /

or a login submis-

sion) that results in a new token being issued. 

188

Chapter 7 

■

Attacking Session Management

70779c07.qxd:WileyRed  9/14/07  3:13 PM  Page 188

---

HACK STEPS (continued)

■

If a bespoke session management mechanism is in use, and you only

have remote access to the application, obtain a large sample of tokens