The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

given the multitude of intercepting proxy tools that are freely available, any

amateur hacker who targets an application can change all request data with

trivial ease. It is rather like supposing that when the teacher comes to search

your desk, it is safer to hide your water pistol in the bottom drawer, because

she will need to bend down further to discover it.

HACK STEPS

■

Locate all instances within the application where hidden form fields,

cookies, and URL parameters are apparently being used to transmit data

via the client.

■

Attempt to determine or guess the purpose that the item plays in the

application’s logic, based on the context in which it appears and on clues

such as the parameter’s name.

■

Modify the item’s value in ways that are relevant to its purpose in the