The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

514

Chapter 14 

■

Exploiting Information Disclosure

70779c14.qxd:WileyRed  9/14/07  3:14 PM  Page 514

---

approach in which objects and data are loaded only when needed. In

this situation, data that has been recently accessed will be retrieved

quickly from the server’s local cached copy, while other data is

retrieved more slowly from the relevant back-end source.

This behavior has been observed in online banking applications, where

a request to access an account takes longer if the account is dormant

than if it is active, enabling a skilled attacker to enumerate accounts that

have been accessed recently by other users.

■■

In some situations, the amount of processing that an application per-

forms on a particular request may depend upon whether a submitted

item of data is valid. For example, when a valid username is supplied to

a login mechanism, the application may perform various database

queries to retrieve account information and to update the audit log, and

may perform computationally intensive operations to validate the sup-

plied password against a stored hash. If an attacker can detect this timing

difference, he may be able to exploit it to enumerate valid usernames.

■■

Some application functions may perform an action on the basis of user

input which will time out if an item of submitted data is not valid. For

example, an application may use a cookie to store the address of a host

located behind a front-end load balancer. An attacker may be able to

manipulate this address to scan for web servers inside the organiza-

tion’s internal network. If the address of an actual server that is not part

of the application infrastructure is supplied, then the application may

immediately return an error. If a nonexistent address is supplied, then

the application may time out attempting to contact this address, before

returning the same generic error.