The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

token is issued each time you log in. If the latter occurs, then the applica-

tion is not really employing proper sessions at all.

■

If tokens appear to contain any structure and meaning, attempt to sepa-

rate out components that may identify the user from those that appear to

be inscrutable. Try to modify any user-related components of the token

so that they refer to other known users of the application, and verify

whether the resulting token (a) is accepted by the application, and (b)

enables you to masquerade as that user.

Vulnerable Session Termination

Proper termination of sessions is important for two reasons. First, keeping the

lifespan of a session as short as is necessary reduces the window of opportu-

nity within which an attacker may capture, guess, or misuse a valid session

token. Second, it provides users with a means of invalidating an existing ses-

sion when they no longer require it, thereby enabling them to reduce this win-

dow further and to take some responsibility for securing their session in a

shared computing environment. The main weaknesses in session termination

functions involve failures to meet these two key objectives.

Some applications do not enforce effective session expiration. Once created, a

session may remain valid for many days after the last request is received, before

it is eventually cleaned up by the server. If tokens are vulnerable to some kind of

sequencing flaw that is particularly difficult to exploit (for example, 100,000

guesses for each valid token identified), an attacker may still be able to capture

the tokens of every user who has accessed the application in the recent past.

Some applications do not provide effective logout functionality:

■■

In some cases, a logout function is simply not implemented. Users have

no means of causing the application to invalidate their session.

■■

In some cases, the logout function does not actually cause the server to

invalidate the session. The server removes the token from the user’s

browser (for example, by issuing a 

Set-Cookie

instruction to blank the