The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

182

Chapter 7 

■

Attacking Session Management

70779c07.qxd:WileyRed  9/14/07  3:13 PM  Page 182

---

guess per 1,000 attempts), this will still enable an automated attack to identify

large numbers of valid tokens in a relatively short period of time. 

Vulnerabilities relating to predictable token generation may be much easier

to discover in commercial implementations of session management, such as

web servers or web application platforms, than they are in bespoke applica-

tions. When you are remotely targeting a bespoke session management mech-

anism, your sample of issued tokens may be restricted by the capacity of the

server, the activity of other users, your bandwidth, network latency, and so on.

In a laboratory environment, however, you can quickly create millions of sam-

ple tokens, all precisely sequenced and time-stamped, and can eliminate inter-

ference caused by other users.

In the simplest and most brazenly vulnerable cases, an application may use

a simple sequential number as the session token. In this case, you only need to

obtain a sample of two or three tokens before launching an attack that will cap-

ture 100% of currently valid sessions very quickly.

Figure 7-1 shows Burp Intruder being used to cycle the last two digits of a

sequential session token to find values where the session is still active and can

be hijacked. The length of the server’s response is here a reliable indicator that

a valid session has been found.

Figure 7-1:  An attack to discover valid sessions where the session token is predictable

In other cases, an application’s tokens may contain more elaborate sequences

that take some effort to discover. The types of potential variations one might

encounter here are open ended, but the authors’ experience in the field indicates

that predictable session tokens commonly arise from three different sources:

■■

Concealed sequences

■■

Time dependency

■■

Weak random number generation

We will look at each of these areas in turn.