the-web-application-hackers-handbook

Chapter 7 n Attacking Session Management 209
for an application to reidentify the user across multiple requests without
using sessions. However, HTTP authentication is rarely used on Internetbased
applications of any complexity, and the other versatile benefits
that fully fledged session mechanisms offer mean that virtually all web
applications do in fact employ these mechanisms.
n Sessionless state mechanisms — Some applications do not issue session
tokens to manage the state of a user’s interaction with the application.
Instead, they transmit all data required to manage that state via the client,
usually in a cookie or a hidden form field. In effect, this mechanism uses
sessionless state much like the ASP.NET ViewState does. For this type
of mechanism to be secure, the data transmitted via the client must be
properly protected. This usually involves constructing a binary blob
containing all the state information and encrypting or signing this using
a recognized algorithm. Sufficient context must be included within the
data to prevent an attacker from collecting a state object at one location
within the application and submitting it to another location to cause some
undesirable behavior. The application may also include an expiration time
within the object’s data to perform the equivalent of session timeouts.
Chapter 5 describes in more detail secure mechanisms for transmitting
data via the client.
HACK STEPS
1. If HTTP authentication is being used, it is possible that no session management
mechanism is implemented. Use the methods described previously to
examine the role played by any token-like items of data.
2. If the application uses a sessionless state mechanism, transmitting all
data required to maintain state via the client, this may sometimes be
difficult to detect with certainty, but the following are strong indicators
that this kind of mechanism is being used:
n Token-like data items issued to the client are fairly long (100 or more bytes).
n The application issues a new token-like item in response to every request.
n The data in the item appears to be encrypted (and therefore has no
discernible structure) or signed (and therefore has a meaningful structure
accompanied by a few bytes of meaningless binary data).
n The application may reject attempts to submit the same item with more
than one request.
3. If the evidence suggests strongly that the application is not using session
tokens to manage state, it is unlikely that any of the attacks described in
this chapter will achieve anything. Your time probably would be better
spent looking for other serious issues such as broken access controls or
code injection.