the-web-application-hackers-handbook

96 Chapter 4 n Mapping the Application
HACK STEPS
1. Identify any instances where application functionality is accessed not by
requesting a specific page for that function (such as /admin/editUser.jsp)
but by passing the name of a function in a parameter (such as
/admin.jsp?action=editUser).
2. Modify the automated techniques described for discovering URL-specified
content to work on the content-access mechanisms in use within the
application. For example, if the application uses parameters that specify
servlet and method names, first determine its behavior when an
invalid servlet and/or method is requested, and when a valid method is
requested with other invalid parameters. Try to identify attributes of the
server’s responses that indicate “hits” — valid servlets and methods. If
possible, find a way of attacking the problem in two stages, first enumerating
servlets and then methods within these. Using a method similar to
the one used for URL-specified content, compile lists of common items,
add to these by inferring from the names actually observed, and generate
large numbers of requests based on these.
3. If applicable, compile a map of application content based on functional
paths, showing all the enumerated functions and the logical paths and
dependencies between them.
Discovering Hidden Parameters
A variation on the situation where an application uses request parameters to
specify which function should be performed arises where other parameters
are used to control the application’s logic in significant ways. For example, an
application may behave differently if the parameter debug=true is added to the
query string of any URL. It might turn off certain input validation checks, allow
the user to bypass certain access controls, or display verbose debug information
in its response. In many cases, the fact that the application handles this
parameter cannot be directly inferred from any of its content (for example, it
does not include debug=false in the URLs it publishes as hyperlinks). The effect
of the parameter can only be detected by guessing a range of values until the
correct one is submitted.