The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

488

Chapter 13 

■

Automating Bespoke Attacks

70779c13.qxd:WileyRed  9/14/07  3:14 PM  Page 488

---

current++;

return current < fuzzStrings.length;

}

public void reset()

{

current = -1;

}

public String getPayload()

{

return fuzzStrings[current];

}   

}

N OT E

Any serious attack to probe the application for security flaws would

need to employ many other attack strings, to identify other weaknesses and

also other variations on the defects previously mentioned. See Chapter 20 for a

more comprehensive list of the strings that are effective when fuzzing a web

application.

To use JAttack for fuzzing, we also need to extend its response analysis

code, to provide more information about each response received from the

application. A simple way to greatly enhance this analysis is to search each

response for a number of common strings and error messages that may indi-

cate that some anomalous behavior has occurred, and record any appearance

within the tool’s output.

First, we can add to the attack configuration data a list of the strings that we

want to search for:

static final String[] grepStrings = new String[]

{

“error”, “exception”, “illegal”, “invalid”, “not found”, “xsstest”

};

Second, we can add the following to the 

parseResponse

method, to search

each response for the preceding strings and log any that are found:

for (String grep : grepStrings)

if (response.indexOf(grep) != -1)

output.append(grep + “\t”);

T I P