The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

200

Chapter 7 

■

Attacking Session Management

70779c07.qxd:WileyRed  9/14/07  3:13 PM  Page 200

---

token). However, if the user continues to submit the token, then it is still

accepted by the server.

■■

In the worst cases, when a user clicks Logout, this fact is not communi-

cated to the server at all, and so the server performs no action whatso-

ever. Rather, a client-side script is executed that blanks the user’s

cookie, meaning that subsequent requests return the user to the login

page. An attacker who gains access to this cookie could use the session

as if the user had never logged out.

HACK STEPS

■