The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

158

Chapter 6 

■

Attacking Authentication

70779c06.qxd:WileyRed  9/14/07  3:13 PM  Page 158

---

HACK STEPS

■

Perform a complete, valid login using an account you control. Record

every piece of data submitted to the application using your intercepting

proxy.

■

Identify each distinct stage of the login and the data that is collected at

each stage. Determine whether any single piece of information is col-

lected more than once or is ever transmitted back to the client and

resubmitted, via a hidden form field, cookie, or preset URL parameter

(see Chapter 5).

■

Repeat the login process numerous times with various malformed

requests:

■