The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

484

Chapter 13 

■

Automating Bespoke Attacks

70779c13.qxd:WileyRed  9/14/07  3:14 PM  Page 484

---

details of any order. Further, the format used for the 

OrderRef

parameter

appears to be a six-digit date followed by a four-digit number. Assuming that

the last four digits are more-or-less sequential, it should be trivial to predict

other users’ order numbers.

When the details for an order are displayed, the page source contains the

personal data within an HTML table like the following:

...

This data could be of huge value to a competitor company or an identity

fraudster. Given the application’s behavior, it is straightforward to mount a

bespoke automated attack to harvest all of the personal customer information

contained within the application.

To do so, let’s make some quick enhancements to the JAttack tool, to enable

it to extract and log specific data from within the server’s responses. First, we

can add to the attack configuration data a list of the strings within the source

code that identify the interesting content we want to extract:

static final String[] extractStrings = new String[]

{

“

Name:	Phill Bellend
Address:	52, Throwley Way
Name:	”, “	Address:	” }; Second, we can add the following to the  parseResponse method, to search each response for each of the above strings and extract what comes next, up until the angle bracket that follows it: for (String extract : extractStrings) { int from = response.indexOf(extract); if (from == -1) continue; from += extract.length(); int to = response.indexOf(“<”, from); if (to == -1) to = response.length(); output.append(response.subSequence(from, to) + “\t”); }