the-web-application-hackers-handbook

150 Chapter 5 n Bypassing Client-Side Controls
(Integer.toHexString((byte)s1.charAt((j * 19 + 7) % s1.length()) ^
s2.charAt(j))).toString();
int k = s3.length();
if(k > 2)
s3 = s3.substring(k - 2, k);
stringbuilder.append(s3);
}
return stringbuilder.toString();
}
}
This version of the modified component provides a valid obfuscated string
for the arbitrary quantity of 999. Note that you could use nonnumeric input
here, allowing you to probe the application for various kinds of input-based
vulnerabilities.
TIP The Jad program saves its decompiled source code with the .jad extension.
However, if you want to modify and recompile the source code, you need
to rename each source file with the .java extension.
All that remains is to recompile the source code using the javac compiler
that comes with the Java SDK, and then execute the component from the
command line:
C:\tmp>javac CheckQuantity.java
C:\tmp>java CheckQuantity
4b282c510f776a455d425a7808015c555f42585460464d1e42684c414a152b1e0b5a520a
145911171609
Our modified component has now performed the necessary obfuscation
on our arbitrary quantity of 999. To deliver the attack to the server, we simply
need to submit the order form in the normal way using valid input, intercept
the resulting request using our proxy, and substitute the obfuscated quantity
with the one provided by our modified component. Note that if the application
issues a new obfuscation pad each time the order form is loaded, you need to
ensure that the obfuscation pad being submitted back to the server matches the
one that was used to obfuscate the quantity also being submitted.
TRY IT!
These examples demonstrate the attack just described and the corresponding
attacks using Silverlight and Flash technologies:
http://mdsec.net/shop/154/
http://mdsec.net/shop/167/
http://mdsec.net/shop/179/