the-web-application-hackers-handbook

Chapter 7 n Attacking Session Management 239
perform some malicious action, such as send spam e-mail, harvest personal
information, or change passwords.
NOTE Current versions of Internet Explorer do not include a Referer header
when following off-site links contained in a page that was accessed over
HTTPS. In this situation, Firefox includes the Referer header provided that the
off-site link is also being accessed over HTTPS, even if it belongs to a different
domain. Hence, sensitive data placed in URLs is vulnerable to leakage in
Referer logs even where SSL is being used.
HACK STEPS
1. Identify all the functionality within the application, and locate any logging
or monitoring functions where session tokens can be viewed. Verify
who can access this functionality–for example, administrators, any
authenticated user, or any anonymous user. See Chapter 4 for techniques
for discovering hidden content that is not directly linked from the main
application.
2. Identify any instances within the application where session tokens are
transmitted within the URL. It may be that tokens are generally transmitted
in a more secure manner but that developers have used the URL in
specific cases to work around particular difficulties. For example, this
behavior is often observed where a web application interfaces with an
external system.
3. If session tokens are being transmitted in URLs, attempt to find any application
functionality that enables you to inject arbitrary off-site links into
pages viewed by other users. Examples include functionality implementing
a message board, site feedback, question-and-answer, and so on. If
so, submit links to a web server you control and wait to see whether any
users’ session tokens are received in your Referer logs.
4. If any session tokens are captured, attempt to hijack user sessions by
using the application as normal but substituting a captured token for your
own. You can do this by intercepting the next response from the server
and adding a Set-Cookie header of your own with the captured cookie
value. In Burp, you can apply a single Suite-wide configuration that sets
a specific cookie in all requests to the target application to allow easy
switching between different session contexts during testing.
6. If a large number of tokens are captured, and session hijacking allows you
to access sensitive data such as personal details, payment information,
or user passwords, you can use the automated techniques described in
Chapter 14 to harvest all desired data belonging to other application users.