The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Transmitting Data via the Client

It is very common to see an application passing data to the client in a form that

is not directly visible or modifiable by the end user, in the expectation that this

Bypassing Client-Side Controls

C H A P T E R

5

70779c05.qxd:WileyRed  9/16/07  5:14 PM  Page 95

---

data will be sent back to the server in a subsequent request. Often, the appli-

cation’s developers simply assume that the transmission mechanism used 

will ensure that the data transmitted via the client will not be modified along

the way.

Because everything submitted from the client to the server is within the

user’s full control, the assumption that data transmitted via the client will not

be modified is usually false, and often leaves the application vulnerable to one

or more attacks.

You may reasonably wonder why, if a particular item of data is known and

specified by the server, the application would ever need to transmit this value

to the client and then read it back. In fact, writing applications in this way is

often an easier task for developers, because it removes the need to keep track

of all kinds of data within the user’s session. Reducing the amount of per-

session data being stored on the server can also improve the application’s

 performance. Further, if an application is deployed on several load-balanced

servers, with users potentially interacting with more than one server to per-

form a multistep action, then it may not be straightforward to share server-

side data between the hosts that may handle the same user’s requests. Using

the client to transmit data can present a tempting solution to the problem.

However, transmitting sensitive data in this way is usually unsafe and has

been the cause of countless vulnerabilities in applications.