The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

If HTTP authentication is being used, it is possible that no session man-

agement mechanism is implemented. Use the methods described previ-

ously to examine the role played by any token-like items of data.

■

If the application uses a sessionless state mechanism, transmitting all

data required to maintain state via the client, this may sometimes be dif-

ficult to detect with certainty,  but the following are strong indicators that

this kind of mechanism is being used:

■

Token-like data items issued to the client are fairly long (e.g., 100 or

more bytes).

(continued)

Chapter 7 

■

Attacking Session Management

179

70779c07.qxd:WileyRed  9/14/07  3:13 PM  Page 179

---