The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Finding Dynamic Execution Vulnerabilities

Most web scripting languages support dynamic execution, and the functions

involved all work in a similar way. Therefore, dynamic execution vulnerabili-

ties can in general be detected using a relatively small set of attack strings that

work on multiple languages and platforms. However, in some cases it may be

necessary to research the syntax and behavior of the particular implementa-

tion you are dealing with. For example, although Java does not itself support

dynamic execution, some custom implementations of the JSP platform may do

so. You should use the information gathered during your application mapping

exercises to investigate any unusual execution environments you encounter.