The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

234

Chapter 8 

■

Attacking Access Controls

70779c08v6.5.qxd  9/14/07  3:18 PM  Page 234

---

Questions

Answers can be found at 

www.wiley.com/go/webhacker

.

1. An application may use the HTTP

Referer

header to control access

without any overt indication of this in its normal behavior. How can

you test for this weakness?

2. You log in to an application and are redirected to the following URL:

https://wahh-app.com/MyAccount.php?uid=1241126841

The application appears to be passing a user identifier to the 

MyAccount.php

page. The only identifier you are aware of is your 

own. How can you test whether the application is using this 

parameter to enforce access controls in an unsafe way?

3. A web application on the Internet enforces access controls by examining

users’ source IP addresses. Why is this behavior potentially flawed?

4. An application’s sole purpose is to provide a searchable repository of

information for use by members of the public. There are no authentica-

tion or session-handling mechanisms. What access controls should be

implemented within the application?

5. You are browsing an application and encounter several sensitive

resources that ought to be protected from unauthorized access, and that

have the 

.xls

file extension. Why should these immediately catch your

attention?