The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 12 

■

Attacking Other Users

443

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 443

---

444

Chapter 12 

■

Attacking Other Users

HACK STEPS

■

Review the key functionality within the application, as enumerated in

your application mapping exercises (see Chapter 4).

■

Find an application function that (a) can be used to perform some sensi-

tive action on behalf of an unwitting user and (b) employs request para-

meters which an attacker can fully determine in advance — that is, which

do not contain any session tokens or other unpredictable items. For

example:

POST /TransferFunds.asp HTTP/1.1

Host: wahh-app.com

FromAccount=current&ToSortCode=123456&ToAccountNumber=

12345678&Amount=1000.00&When=now

■