The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

150

Chapter 6 

■

Attacking Authentication

70779c06.qxd:WileyRed  9/14/07  3:13 PM  Page 150

---

Figure 6-7: A password-guessing attack with two “hits,” 

indicating the presence of a backdoor password

HACK STEPS

■

Identify any impersonation functionality within the application. If this is

not explicitly linked from published content, it may still be implemented

(see Chapter 4). 

■

Attempt to use the impersonation functionality directly to impersonate

other users.

■

Attempt to manipulate any user-supplied data that is processed by the

impersonation function in an attempt to impersonate other users. Pay