the-web-application-hackers-handbook

Chapter 4 n Mapping the Application 97
HACK STEPS
1. Using lists of common debug parameter names (debug, test, hide, source,
etc.) and common values (true, yes, on, 1, etc.), make a large number of
requests to a known application page or function, iterating through all
permutations of name and value. For POST requests, insert the added
parameter to both the URL query string and the message body.
Burp Intruder can be used to perform this test using multiple payload
sets and the “cluster bomb” attack type (see Chapter 14 for more details).
2. Monitor all responses received to identify any anomalies that may indicate
that the added parameter has had an effect on the application’s processing.
3. Depending on the time available, target a number of different pages or
functions for hidden parameter discovery. Choose functions where it is
most likely that developers have implemented debug logic, such as login,
search, and file uploading and downloading.
Analyzing the Application
Enumerating as much of the application’s content as possible is only one element
of the mapping process. Equally important is the task of analyzing the
application’s functionality, behavior, and technologies employed to identify the
key attack surfaces it exposes and to begin formulating an approach to probing
the application for exploitable vulnerabilities.
Here are some key areas to investigate:
n The application’s core functionality — the actions that can be leveraged
to perform when used as intended
n Other, more peripheral application behavior, including off-site links, error
messages, administrative and logging functions, and the use of redirects
n The core security mechanisms and how they function — in particular,
management of session state, access controls, and authentication mechanisms
and supporting logic (user registration, password change, and
account recovery)