The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 9 

■

Injecting Code

309

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 309

---

310

Chapter 9 

■

Injecting Code

HACK STEPS

■

Any item of user-supplied data may be passed to a dynamic execution

function. Some of the items most commonly used in this way are the

names and values of cookie parameters, and persistent data stored in

user profiles as the result of previous actions.

■

Try submitting the following values in turn as each targeted parameter:

;echo%20111111

echo%20111111

response.write%20111111

:response.write%20111111

■

Review the application’s responses. If the string 

111111

is returned on

its own (i.e., not preceded by the rest of the command string), then the

application is likely to be vulnerable to injection of scripting commands.

■

If the string 

111111

is not returned, look for any error messages that

indicate that your input is being dynamically executed and that you may

need to fine-tune your syntax to achieve injection of arbitrary commands.

■