The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

In certain situations, an ability to leach information via a search function

in this way may be critical to the security of the application itself — effectively

disclosing details of administrative functions, passwords, and technologies 

in use.

Example 10: Snarfing Debug Messages

The authors encountered this logic flaw in a web application used by a finan-

cial services company.

The Functionality

The application was only recently deployed and like much new software still

contained a number of functionality-related bugs. Intermittently, various oper-

ations would fail in an unpredictable way, and users would be presented with

an error message.

To facilitate the investigation of errors, developers decided to include

detailed verbose information in these messages, including the following

details:

■■

The user’s identity.

■■

The token for the current session.

■■

The URL being accessed.

■■

All of the parameters supplied with the request which generated the

error.

70779c11.qxd:WileyRed  9/14/07  3:14 PM  Page 366

---

Generating these messages had proved useful when helpdesk personnel

attempted to investigate and recover from system failures, and were helping to

iron out the remaining functionality bugs.