The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 12 

■

Attacking Other Users

441

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 441

---

442

Chapter 12 

■

Attacking Other Users

though XSS was not possible. And of course, the attack will succeed even if

administrators take the precaution of disabling JavaScript.

In the preceding attack string, note the 

#

character that effectively termi-

nates the URL before the 

.gif

suffix. You could just as easily use 

&

to incorpo-

rate the suffix as a further request parameter.

HACK STEPS

■

In every location where data submitted by one user is displayed to other

users but you are unable to perform a stored XSS attack, review whether