The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Harvesting data — 

There are many kinds of web application vulnera-

bilities that enable you to extract useful or sensitive data from the appli-

cation using specific crafted requests. For example, a personal profile

page may display the personal and banking details of the current user

and indicate that user’s privilege level within the application. Through

an access control defect, you may be able to view the personal profile

page of any application user — but only one user at a time. To harvest

this data for every user might require thousands of individual requests.

Rather than working manually, you can use a bespoke automated

attack to quickly capture all of this data in a useful form.

An example of harvesting useful data would be to extend the enumera-

tion attack described previously. Instead of simply confirming which

PageNo

values are valid, your automated attack could extract the con-

tents of the HTML title tag from each page it retrieves, enabling you to

quickly scan the list of pages for those that are most interesting.

■■