the-web-application-hackers-handbook

Chapter 5 n Bypassing Client-Side Controls 129
It updates each time the resource is modified. If the server possesses a newer
version of the resource than the date specified in the If-Modified-Since
header, or if the Etag of the current version matches the one specified in the
If-None-Match header, the server responds with the latest version of the
resource. Otherwise, it returns a 304 response, as shown here, informing the
browser that the resource has not been modified and that the browser should
use its cached copy.
When this occurs, and you need to intercept and modify the resource that
the browser has cached, you can intercept the relevant request and remove
the If-Modified-Since and If-None-Match headers. This causes the server
to respond with the full version of the requested resource. Burp Proxy contains
an option to strip these headers from every request, thereby overriding
all cache information sent by the browser.
HACK STEPS
1. Look for form elements containing a maxlength attribute. Submit data
that is longer than this length but that is formatted correctly in other
respects (for example, it is numeric if the application expects a number).
2. If the application accepts the overlong data, you may infer that the clientside
validation is not replicated on the server.
3. Depending on the subsequent processing that the application performs
on the parameter, you may be able to leverage the defects in validation to
exploit other vulnerabilities, such as SQL injection, cross-site scripting, or
buffer overflows.
Script-Based Validation
The input validation mechanisms built into HTML forms themselves are extremely
simple and are insufficiently fine-grained to perform relevant validation of
many kinds of input. For example, a user registration form might contain fields
for name, e-mail address, telephone number, and zip code, all of which expect
different types of input. Therefore, it is common to see customized client-side
input validation implemented within scripts. Consider the following variation
on the original example:
Product: Samsung Multiverse
Price: 399