The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

156

Chapter 6 

■

Attacking Authentication

70779c06.qxd:WileyRed  9/14/07  3:13 PM  Page 156

---

In the field, one would not expect code like this to pass even the most cur-

sory security review. However, the same conceptual flaw is much more likely

to exist in more complex mechanisms in which numerous layered method

invocations are made, in which many potential errors may arise and be han-

dled in different places, and where the more complicated validation logic may

involve maintaining significant state about the progress of the login.

HACK STEPS

■