The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Automating Bespoke Attacks

C H A P T E R

13

70779c13.qxd:WileyRed  9/14/07  3:14 PM  Page 471

---

Uses for Bespoke Automation

There are three main situations in which bespoke automated techniques can be

employed to assist you in attacking a web application:

■■

Enumerating identifiers — 

Most applications use various kinds of

names and identifiers to refer to individual items of data and resources,

such as account numbers, usernames, and document IDs. It is fre-

quently the case that you need to iterate through a very large number of

potential identifiers, to enumerate which ones are valid or worthy of

further investigation. In this situation, you can use automation in a

fully bespoke way to work through a list of possible identifiers or cycle

through the syntactic range of identifiers believed to be in use by the

application.

An example of an attack to enumerate identifiers would be where an

application uses a page number parameter to retrieve specific content:

https://wahh-app.com/app/showPage.jsp?PageNo=244197

In the course of browsing through the application, you discover a large

number of valid 

PageNo

values, but to identify every valid value you

need to cycle through the entire range — something you cannot feasibly

do manually.

■■