the-web-application-hackers-handbook

210 Chapter 7 n Attacking Session Management
Weaknesses in Token Generation
Session management mechanisms are often vulnerable to attack because tokens
are generated in an unsafe manner that enables an attacker to identify the values
of tokens that have been issued to other users.
NOTE There are numerous locations where an application’s security
depends on the unpredictability of tokens it generates. Here are some
examples:
n Password recovery tokens sent to the user’s registered e-mail address
n Tokens placed in hidden form fields to prevent cross-site request forgery
attacks (see Chapter 13)
n Tokens used to give one-time access to protected resources
n Persistent tokens used in “remember me” functions
n Tokens allowing customers of a shopping application that does not use
authentication to retrieve the current status of an existing order
The considerations in this chapter relating to weaknesses in token generation
apply to all these cases. In fact, because many of today’s applications rely on
mature platform mechanisms to generate session tokens, it is often in these
other areas of functionality that exploitable weaknesses in token generation
are found.
Meaningful Tokens
Some session tokens are created using a transformation of the user’s username
or e-mail address, or other information associated with that person. This information
may be encoded or obfuscated in some way and may be combined with
other data.
For example, the following token may initially appear to be a long random
string:
757365723d6461663b6170703d61646d696e3b646174653d30312f31322f3131
However, on closer inspection, you can see that it contains only hexadecimal
characters. Guessing that the string may actually be a hex encoding of a string
of ASCII characters, you can run it through a decoder to reveal the following:
user=daf;app=admin;date=10/09/11