The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

76

Chapter 4 

■

Mapping the Application

70779c04.qxd:WileyRed  9/14/07  3:12 PM  Page 76

---

different picture, based on functional paths, is far more useful for cataloging

its content and functionality. Consider an application that is accessed using

only requests of the following form:

POST /bank.jsp HTTP/1.1

Host: wahh-bank.com

Content-Length: 106

servlet=TransferFunds&method=confirmTransfer&fromAccount=10372918&toAcco

unt=3910852&amount=291.23&Submit=Ok

Here, every request is made to a single URL. The parameters to the request

are used to tell the application what function to perform, by naming the Java

servlet and method to invoke. Further parameters provide the information to

use in performing the function. In the picture based on application pages, the

application will appear to have only a single function, and a URL-based map

will not elucidate its functionality. However, if we map the application in

terms of functional paths, we can obtain a much more informative and useful

catalogue of its functionality. Figure 4-5 is a partial map of the functional paths

that exist within the application.

Figure 4-5:  A mapping of the functional paths within a web application

WahhBank. 

login 

WahhBank. 

home 

TransferFunds. 

selectAccounts 

BillPayment. 

addPayee 

BillPayment. 

selectPayee 

TransferFunds. 

enterAmount 

BillPayment. 

enterAmount 

TransferFunds. 

confirmTransfer 

BillPayment. 

confirmPayment 

WahhBank. 

logout