The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

108

Chapter 5 

■

Bypassing Client-Side Controls

70779c05.qxd:WileyRed  9/16/07  5:14 PM  Page 108

---

logic to intercept an attempted form submission, perform customized validation

checks on the user’s input, and decide whether to accept that input accordingly.

In the above example, the validation is extremely simple and checks whether the

data entered in the amount field is an integer.

Client-side controls of this kind are usually trivial to circumvent, and it is

normally sufficient to disable JavaScript within the browser. If this is done, the

onsubmit

attribute is ignored, and the form is submitted without any custom

validation.

However, disabling JavaScript altogether may break the application if it

depends upon client-side scripting for its normal operation (such as construct-

ing parts of the user interface). A neater approach is to enter a benign value

into the input field in the browser, and then intercept the validated submission

with your proxy and modify the data to your desired value.

Alternatively, you can intercept the server’s response that contains the

JavaScript validation routine and modify the script to neutralize its effect — in

the previous example, by changing the 

ValidateForm

function to return true in

every case.

HACK STEPS

■