The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 7 

■

Attacking Session Management

197

70779c07.qxd:WileyRed  9/14/07  3:13 PM  Page 197

---

HACK STEPS

■

Identify all of the functionality within the application and locate any log-

ging or monitoring functions where session tokens can be viewed. Verify

who is able to access this functionality–for example, administrators, any

authenticated user, or any anonymous user. See Chapter 4 for techniques

for discovering hidden content that is not directly linked from the main

application.

■

Identify any instances within the application where session tokens are

transmitted within the URL. It may be that tokens are generally transmit-

ted in a more secure manner but that developers have used the URL in