The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 9 

■

Injecting Code

313

70779c09.qxd:WileyRed  9/14/07  3:13 PM  Page 313

---

314

Chapter 9 

■

Injecting Code

Note how the XML elements in the message correspond to the parameters in

the HTTP request, and also the addition of the 

ClearedFunds

element. At this

point in the application’s logic, it has determined that there are insufficient

funds available to perform the requested transfer, and has set the value of this

element to 

False

, with the result that the component which receives the SOAP

message does not act upon it.

In this situation, there are various ways in which you could seek to inject

into the SOAP message, and so interfere with the application’s logic. For exam-

ple, submitting the following request will cause an additional 

ClearedFunds

element to be inserted into the message before the original element (while pre-

serving the SQL’s syntactic validity). If the application processes the first

ClearedFunds

element that it encounters, then you may succeed in performing

a transfer when no funds are available:

POST /transfer.asp HTTP/1.0

Host: wahh-bank.com

Content-Length: 119

FromAccount=18281008&Amount=