The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 2 

■

Core Defense Mechanisms

31

70779c02.qxd:WileyRed  9/14/07  3:12 PM  Page 31

---

 having any undesirable effect on the application. However, it is sensible to

assume that some bypasses to these filters exist, and that the application does

contain some actual vulnerabilities waiting to be discovered and exploited. At

some point, an attacker working systematically is likely to discover these

defects.

For this reason, some applications take automatic reactive measures to frus-

trate the activities of an attacker who is working in this way, for example by

responding increasingly slowly to the attacker’s requests or by terminating the

attacker’s session, requiring him to log in or perform other steps before con-

tinuing the attack. While these measures will not defeat the most patient and

determined attacker, they will deter many more casual attackers, and will buy

additional time for administrators to monitor the situation and take more

drastic action if desired.

Reacting to apparent attackers is not, of course, a substitute for fixing any

vulnerabilities that exist within the application. However, in the real world,

even the most diligent efforts to purge an application of security flaws may

leave some exploitable defects remaining. Placing further obstacles in the way

of an attacker is an effective defense-in-depth measure that reduces the likeli-

hood that any residual vulnerabilities will be found and exploited.