The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Identify any password change functionality within the application. If this

is not explicitly linked from published content, it may still be imple-

mented. Chapter 4 describes various techniques for discovering hidden

content within an application. 

■

Make various requests to the password change function, using invalid

usernames, invalid existing passwords, and mismatched “new password”

and “confirm new password” values.

■

Try to identify any behavior that can be used for username enumeration

or brute-force attacks (as described in the “Brute-Forcible Login” and

“Verbose Failure Messages” sections).

144

Chapter 6 

■

Attacking Authentication

70779c06.qxd:WileyRed  9/14/07  3:13 PM  Page 144

---

T I P