The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

N OT E

For an attacker targeting an organization, gaining access to the

network or executing arbitrary commands on servers may well not be what 

they really want to achieve. Often, and perhaps typically, what an attacker

really desires is to perform some application-level action such as stealing

personal information, transferring funds, or making cheap purchases. And the

relocation of the security perimeter to the application layer may greatly assist

an attacker in achieving these objectives.

For example, suppose that an attacker wishes to “hack in” to a bank’s systems

and steal money from users’ accounts. Before the bank deployed a web

application, the attacker might have needed to find a vulnerability in a publicly

reachable service, exploit this to gain a toehold on the bank’s DMZ, penetrate