The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

useful GNU utilities such as 

head

and 

grep

.

You can achieve the same result just as easily in a Windows batch script. The

following example uses the 

curl

tool to generate requests and the 

findstr

command to filter the output:

for /f “tokens=1” %i in (IDs.txt) do echo %i && curl 

wahh-app.com/ShowDoc.jsp?docId=%i -i -s | findstr /B HTTP/1.0

While simple scripts like these are ideal for performing a straightforward

task like cycling through a list of parameter values and parsing the server’s

response for a single attribute, in many situations you are likely to require

more power and flexibility than command-line scripting can readily offer. The

authors’ preference is to use a suitable high-level object-orientated language

that enables easy manipulation of string-based data and provides accessible

APIs for using sockets and SSL. Languages that satisfy these criteria include

Java, C#, and Python. We will look in more depth at an example using Java.

JAttack

JAttack is a simple but versatile tool that demonstrates how anyone with some

basic programming knowledge can use bespoke automation to deliver very

powerful attacks against an application. The full source code for this tool can

be downloaded from the companion web site (

www.wiley.com/go/webhacker

)

to this book. More important than the actual code, however, are the basic tech-

niques involved, which we will explain shortly.