The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

194

Chapter 7 

■

Attacking Session Management

70779c07.qxd:WileyRed  9/14/07  3:13 PM  Page 194

---

HACK STEPS

■

Walk through the application in the normal way from first access (the

“start” URL), through the login process, and then through all of the appli-

cation’s functionality. Keep a record of every URL visited, and note every

instance in which a new session token is received. Pay particular atten-

tion to login functions and transitions between HTTTP and HTTPS com-

munications. This can be achieved manually using a network sniffer such

as Wireshark or partially automated using the logging functions of your

intercepting proxy:

■

If HTTP cookies are being used as the transmission mechanism for ses-