The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Set-Cookie Header

Occasionally, the application may respond in an identical way to any set of

parameters, with the exception that a cookie is set in certain cases. For exam-

ple, every login request might be met with the same redirect, but in the case of

valid credentials, the application sets a cookie containing a session token. The

content that the client receives when it follows the redirect will depend on

whether a valid session token is submitted.

Chapter 13 

■

Automating Bespoke Attacks

475

70779c13.qxd:WileyRed  9/14/07  3:14 PM  Page 475

---

Time Delays

Occasionally, the actual contents of the server’s response may be identical

when valid and invalid parameters are submitted, but the time taken to return

the response may differ subtly. For example, when an invalid username is sub-

mitted to a login function, the application may respond immediately with a

generic, uninformative message. However, when a valid username is submit-

ted, the application may perform various back-end processing to validate the

supplied credentials, some of which is computationally intensive, before

returning the same message if the credentials are incorrect. If you can detect

this time difference remotely, then it can be used as a discriminator to identify

hits in your attack. (This bug is also often found in other types of software,

such as older versions of OpenSSH.)

T I P