the-web-application-hackers-handbook

Chapter 4 n Mapping the Application 99
In this example, the strings electronics and iPhone3G should be treated as
parameters to store a search function.
Similarly, in this URL:
http://eis/updates/2010/12/25/my-new-iphone/
each of the URL components following updates may be being handled in a
RESTful manner.
Most applications using REST-style URLs are easy to identify given the URL
structure and application context. However, no hard-and-fast rules should be
assumed when mapping an application, because it is up to the application’s
authors how users should interact with it.
Request Parameters
Parameters submitted within the URL query string, message body, and HTTP
cookies are the most obvious entry points for user input. However, some applications
do not employ the standard name=value format for these parameters.
They may employ their own custom scheme, which may use nonstandard query
string markers and field separators, or they may embed other data schemes such
as XML within parameter data.
Here are some examples of nonstandard parameter formats that the authors
have encountered in the wild:
n /dir/file;foo=bar&foo2=bar2
n /dir/file?foo=bar$foo2=bar2
n /dir/file/foo%3dbar%26foo2%3dbar2
n /dir/foo.bar/file
n /dir/foo=bar/file
n /dir/file?param=foo:bar
n /dir/file?data=%3cfoo%3ebar%3c%2ffoo%3e%3cfoo2%3ebar2%3c%2ffoo2%3e
If a nonstandard parameter format is being used, you need to take this into
account when probing the application for all kinds of common vulnerabilities.
For example, suppose that, when testing the final URL in this list, you ignore the
custom format and simply treat the query string as containing a single parameter
called data, and therefore submit various kinds of attack payloads as the value
of this parameter. You would miss many kinds of vulnerabilities that may exist
in the processing of the query string. Conversely, if you dissect the format and
place your payloads within the embedded XML data fields, you may immediately
discover a critical bug such as SQL injection or path traversal.