The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

470

Chapter 12 

■

Attacking Other Users

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 470

---

471

This chapter does not introduce any new categories of vulnerability. Rather,

we will be examining one key element in an effective methodology for hacking

web applications — that is, the use of automation to strengthen and accelerate

bespoke attacks. The range of techniques involved can be applied throughout

the application and to every stage of the attack process, from initial mapping

to actual exploitation.

Every web application is different. Attacking an application effectively

involves using various manual procedures and techniques to understand its

behavior and probe for vulnerabilities. It also entails bringing to bear your

experience and intuition in an imaginative way. Attacks are typically bespoke,

or custom-made, in nature, tailored to the particular behavior you have iden-

tified, and the specific ways in which the application enables you to interact

with and manipulate it. Performing bespoke attacks manually can be

extremely laborious and is prone to mistakes. The most successful web appli-

cation hackers take their bespoke attacks a step further, and find ways of

automating these to make them easier, faster, and more effective.

In this chapter, we will describe a proven methodology for automating

bespoke attacks. This methodology combines the virtues of human intelli-

gence and computerized brute force, usually with devastating results.