the-web-application-hackers-handbook

70 Chapter 3 n Web Application Technologies
As with Base64, hex-encoded data is usually easy to spot. You should always
attempt to decode any such data that the server sends to the client to understand
its function.
Remoting and Serialization Frameworks
In recent years, various frameworks have evolved for creating user interfaces in
which client-side code can remotely access various programmatic APIs implemented
on the server side. This allows developers to partly abstract away from
the distributed nature of web applications and write code in a manner that is
closer to the paradigm of a conventional desktop application. These frameworks
typically provide stub APIs for use on the client side. They also automatically
handle both the remoting of these API calls to the relevant server-side functions
and the serialization of any data that is passed to those functions.
Examples of these kinds of remoting and serialization frameworks include
the following:
n Flex and AMF
n Silverlight and WCF
n Java serialized objects
We will discuss techniques for working with these frameworks, and the kinds
of security issues that can arise, in Chapters 4 and 5.
Next Steps
So far, we have described the current state of web application (in)security, examined
the core mechanisms by which web applications can defend themselves,
and taken a brief look at the key technologies employed in today’s applications.
With this groundwork in place, we are now in a position to start looking at the
actual practicalities of attacking web applications.
In any attack, your first task is to map the target application’s content and
functionality to establish how it functions, how it attempts to defend itself, and
what technologies it uses. The next chapter examines this mapping process
in detail and shows how you can use it to obtain a deep understanding of an
application’s attack surface. This knowledge will prove vital when it comes to
finding and exploiting security flaws within your target.