The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 13 

■

Automating Bespoke Attacks

477

70779c13.qxd:WileyRed  9/14/07  3:14 PM  Page 477

---

Rather than just working with a request as an unstructured block of text, we

need the tool to understand the concept of a request parameter — that is, a

named item of data that can be manipulated and is attached to a request in a

particular way. Request parameters may appear in the URL query string,

HTTP cookies, or the body of a 

POST

request. Let’s start by creating a 

Param

class to hold the relevant details: 

// JAttack.java

// by Dafydd Stuttard

import java.net.*;

import java.io.*;

class Param

{

String name, value;

Type type;

boolean attack;

Param(String name, String value, Type type, boolean attack)

{

this.name = name;

this.value = value;

this.type = type;

this.attack = attack;

}

enum Type 

{ 

URL, COOKIE, BODY 

}

}

In many situations, a request will contain parameters that we do not wish to

modify in a given attack, but that we still need to include for the attack to suc-

ceed. We can use the “attack” field to flag whether a given parameter is being

subjected to modification in the current attack.

In order to modify the value of a selected parameter in crafted ways, we

need our tool to understand the concept of an attack payload. In different

types of attack, we will need to create different payload sources. Let’s build

some flexibility into the tool up front, and create an interface that all payload

sources must implement:

interface PayloadSource

{

boolean nextPayload();

void reset();

String getPayload();

}