The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 13 

■

Automating Bespoke Attacks

473

70779c13.qxd:WileyRed  9/14/07  3:14 PM  Page 473

---

The Basic Approach

Your first task in formulating a bespoke automated attack to enumerate valid

identifiers is to locate a request/response pair which has the following charac-

teristics:

■■

The request includes a parameter containing the identifier that you are

targeting. For example, in a function that displays a stored document,

the request might contain the parameter 

docID=3801

.

■■

The server’s response to this request varies in a systematic way 

when you vary the parameter’s value. For example, if a valid 

docId

is

requested, the server might return a long response containing the speci-

fied document’s contents. If an invalid value is requested, it might

return a short response containing the string 

Invalid document ID

.

Having located a suitable request/response pair, the basic approach

involves submitting a large number of automated requests to the application,

either working through a list of potential identifiers, or iterating through the

syntactic range of identifiers known to be in use. The application’s responses

to these requests are monitored for “hits,” indicating that a valid identifier was

submitted.

Detecting Hits

There are numerous attributes of responses in which systematic variations

may be detected, and which may therefore provide the basis for an automated

attack.