The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

482

Chapter 13 

■

Automating Bespoke Attacks

70779c13.qxd:WileyRed  9/14/07  3:14 PM  Page 482

---

while (nextRequest())

{

try

{

output = parseResponse(issueRequest(buildRequest()));

}

catch (Exception e)

{

output = e.toString();

}

System.out.println(params[currentParam].name + “\t” + 

payloads.getPayload() + “\t” + output);

}

}

public static void main(String[] args)

{

new JAttack().doAttack();

}

}

That’s it! To compile and run this code, you will need to download the Java

SDK and JRE from Sun, and then execute the following:

> javac JAttack.java

> java JAttack

In our example configuration, the tool’s output is:

param   payload status  length

DocID   3000    500     220

DocID   3001    200     48179

DocID   3002    200     62881

DocID   3003    500     220

...

Assuming a normal network connection and amount of processing power,

JAttack is capable of issuing hundreds of individual requests per minute and

outputting the pertinent details, enabling you to very quickly identify valid

document identifiers for further investigation.

It may appear that the attack just illustrated is no more sophisticated than

the original bash script example, which required only a few lines of code.

However, because of the way JAttack is engineered, it is trivial to modify it to

deliver much more sophisticated attacks, incorporating multiple request para-

meters, a variety of different payload sources, and arbitrarily complex pro-

cessing of responses. In the following sections, we will make some minor

additions to JAttack’s code, which make it considerably more powerful.