the-web-application-hackers-handbook

Chapter 6 n Attacking Authentication 179
the backdoor password and therefore gain access to every user’s account.
Similarly, a brute-force attack might result in two different “hits,” thereby
revealing the backdoor password, as shown in Figure 6-8.
Figure 6-7: A vulnerable user impersonation function
HACK STEPS
1. Identify any impersonation functionality within the application. If this is
not explicitly linked from published content, it may still be implemented
(see Chapter 4).
2. Attempt to use the impersonation functionality directly to impersonate
other users.
3. Attempt to manipulate any user-supplied data that is processed by the
impersonation function in an attempt to impersonate other users. Pay
particular attention to any cases where your username is being submitted
other than during normal login.
4. If you succeed in making use of the functionality, attempt to impersonate
any known or guessed administrative users to elevate privileges.
5. When carrying out password-guessing attacks (see the “Brute-Forcible
Login” section), review whether any users appear to have more than one
valid password, or whether a specific password has been matched against
several usernames. Also, log in as many different users with the credentials
captured in a brute-force attack, and review whether everything appears
normal. Pay close attention to any “logged in as X” status message.