The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 12 

■

Attacking Other Users

417

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 417

---

418

Chapter 12 

■

Attacking Other Users

properly crafted attack. Short of submitting every conceivable XSS attack

string into every parameter, the basic approach will inevitably miss a large

number of vulnerabilities.

A more effective approach to identifying DOM-based XSS bugs is to review

all client-side JavaScript for any use of DOM properties that may lead to a 

vulnerability.

HACK STEPS

Using the results of your application mapping exercises (see Chapter 4), review

every piece of client-side JavaScript for the following APIs, which may be used

to access DOM data that is controllable via a crafted URL:

■

document.location

■

document.URL

■

document.URLUnencoded

■

document.referrer

■

window.location