the-web-application-hackers-handbook

Chapter 4 n Mapping the Application 107
Identifying Server-Side Functionality
It is often possible to infer a great deal about server-side functionality and structure,
or at least make an educated guess, by observing clues that the application
discloses to the client.
Dissecting Requests
Consider the following URL, which is used to access a search function:
https://wahh-app.com/calendar.jsp?name=new%20applicants&isExpired=
0&startDate=22%2F09%2F2010&endDate=22%2F03%2F2011&OrderBy=name
As you have seen, the .jsp file extension indicates that Java Server Pages are
in use. You may guess that a search function will retrieve its information from
either an indexing system or a database. The presence of the OrderBy parameter
suggests that a back-end database is being used and that the value you submit
may be used as the ORDER BY clause of a SQL query. This parameter may well
be vulnerable to SQL injection, as may any of the other parameters if they are
used in database queries (see Chapter 9).
Also of interest among the other parameters is the isExpired field. This
appears to be a Boolean flag specifying whether the search query should include
expired content. If the application designers did not expect ordinary users to
be able retrieve any expired content, changing this parameter from 0 to 1 could
identify an access control vulnerability (see Chapter 8).
The following URL, which allows users to access a content management
system, contains a different set of clues:
https://wahh-app.com/workbench.aspx?template=NewBranch.tpl&loc=
/default&ver=2.31&edit=false
Here, the .aspx file extension indicates that this is an ASP.NET application. It also
appears highly likely that the template parameter is used to specify a filename,
and the loc parameter is used to specify a directory. The possible file extension
.tpl appears to confirm this, as does the location /default, which could very
well be a directory name. It is possible that the application retrieves the template
file specified and includes the contents in its response. These parameters may
well be vulnerable to path traversal attacks, allowing arbitrary files to be read
from the server (see Chapter 10).
Also of interest is the edit parameter, which is set to false. It may be that
changing this value to true will modify the registration functionality, potentially
enabling an attacker to edit items that the application developer did not
intend to be editable. The ver parameter does not have any readily guessable
purpose, but it may be that modifying this will cause the application to perform
a different set of functions that an attacker could exploit.