The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Modifying the Search Filter

In some situations, the user-supplied input is not used directly as the entire

value of the search filter but is embedded in a more complex filter. For exam-

ple, if the user performing the search is only allowed to view the details of

employees based in France, the application might perform the following

query:

;(&(givenName=GUILL)(c=FR));cn,telephoneNumber,depart

ment,c

328

Chapter 9 

■

Injecting Code

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 328

---

This uses the 

&

operator to combine two conditions — the first controlled by

the user and the second preset by the application. Supplying the search term 

*

will return the details of all users based in France. However, supplying the

string

*));cn,cn;

causes the application to make the following query:

;(&(givenName=*));cn,cn;)(c=FR));cn,telephoneNumber,d

epartment,c

which subverts the application’s original logic, removing the 

(c=FR)

condition

from the search filter, thus returning the results of all users in all countries, as

shown in Figure 9-12.

Figure 9-12: A successful attack to subvert the intended search filter