The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

498

Chapter 13 

■

Automating Bespoke Attacks

70779c13.qxd:WileyRed  9/14/07  3:14 PM  Page 498

---

Figure 13-5:  Positioning the payload

When a log file entry contains a listing of user-supplied parameters, the rel-

evant part of the HTML source looks like this:

action=search

source=homeware

sort=price

start=20

q=toaster

You can configure Intruder to capture all of this information in a usable form

with the Extract Grep function. This works in a similar way to the extract func-

tion of JAttack — you specify the expression which precedes the item you

want to extract. However, in the present case, there are a variable number of

items you want to extract, each preceded by the same expression. To handle

this scenario, you simply need to enter this expression multiple times, and

Intruder will search through the response for each occurrence, capturing

whatever comes next, until no more occurrences are found, as shown in

 Figure 13-6.

Launching this attack quickly iterates through all of the log file entries in the

range specified. Many of the entries contain debugging information and show

the details of the data submitted by the user. As before, you can sort the results

by the first extracted data column, to quickly review this for interesting items,

as shown in Figure 13-7.