the-web-application-hackers-handbook

Chapter 7 n Attacking Session Management 211
Attackers can exploit the meaning within this session token to attempt to
guess the current sessions of other application users. Using a list of enumerated
or common usernames, they can quickly generate large numbers of potentially
valid tokens and test these to confirm which are valid.
Tokens that contain meaningful data often exhibit a structure. In other words,
they contain several components, often separated by a delimiter, that can be
extracted and analyzed separately to allow an attacker to understand their
function and means of generation. Here are some components that may be
encountered within structured tokens:
n The account username
n The numeric identifier that the application uses to distinguish between
accounts
n The user’s first and last names
n The user’s e-mail address
n The user’s group or role within the application
n A date/time stamp
n An incrementing or predictable number
n The client IP address
Each different component within a structured token, or indeed the entire
token, may be encoded in different ways. This can be a deliberate measure to
obfuscate their content, or it can simply ensure safe transport of binary data via
HTTP. Encoding schemes that are commonly encountered include XOR, Base64,
and hexadecimal representation using ASCII characters (see Chapter 3). It may
be necessary to test various decodings on each component of a structured token
to unpack it to its original form.
NOTE When an application handles a request containing a structured token,
it may not actually process every component with the token or all the data
contained in each component. In the previous example, the application may
Base64-decode the token and then process only the “user” and “date” components.
In cases where a token contains a blob of binary data, much of this
data may be padding. Only a small part of it may actually be relevant to the
validation that the server performs on the token. Narrowing down the subparts
of a token that are actually required can often considerably reduce the
amount of apparent entropy and complexity that the token contains.