The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

their access to administrative functionality needs to be withdrawn, there is no

way to delete their knowledge of a particular URL.

In some applications where sensitive functionality is hidden behind URLs

that are not trivial to guess, an attacker may often be able to identify these via

close inspection of client-side code. Many applications use JavaScript to build

the user interface dynamically within the client. This typically works by set-

ting various flags regarding the user’s status, and then adding individual ele-

ments to the UI on the basis of these. For example:

var isAdmin = false;

...

if (isAdmin)

{

adminMenu.addItem(“/menus/secure/ff457/addNewPortalUser2.jsp”,

“create a new user”);

}

Here, an attacker can simply review the JavaScript to identify URLs for

administrative functionality and attempt to access these. In other cases, HTML

comments may contain references to or clues about URLs that are not linked

from on-screen content. See Chapter 4 for a discussion of the various tech-

niques by which an attacker can gather information about hidden content

within the application.