The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 13 

■

Automating Bespoke Attacks

503

70779c13.qxd:WileyRed  9/14/07  3:14 PM  Page 503

---

70779c13.qxd:WileyRed  9/14/07  3:14 PM  Page 504

---

505

In Chapter 4, we described various techniques you can use to map a target

application and gain an initial understanding of how it works. That methodol-

ogy involved interacting with the application in largely benign ways, to cata-

log its content and functionality, determine the technologies in use, and

identify the key attack surface.

In this chapter, we describe ways in which you can extract further informa-

tion from an application during an actual attack. This mainly involves interact-

ing with the application in unexpected and malicious ways, and exploiting

anomalies in the application’s behavior in order to extract information that is of

value to you. If successful, such an attack may enable you to retrieve sensitive

data such as user credentials, gain a deeper understanding of an error condition

in order to fine-tune your attack, discover more detail about the technologies in

use, and map the application’s internal structure and functionality.