the-web-application-hackers-handbook

244 Chapter 7 n Attacking Session Management
HACK STEPS
1. Identify any cross-site scripting vulnerabilities within the application, and
determine whether these can be exploited to capture the session tokens
of other users (see Chapter 12).
2. If the application issues session tokens to unauthenticated users, obtain a
token and perform a login. If the application does not issue a fresh token
following a successful login, it is vulnerable to session fixation.
3. Even if the application does not issue session tokens to unauthenticated
users, obtain a token by logging in, and then return to the login page. If
the application is willing to return this page even though you are already
authenticated, submit another login as a different user using the same
token. If the application does not issue a fresh token after the second
login, it is vulnerable to session fixation.
4. Identify the format of session tokens used by the application. Modify your
token to an invented value that is validly formed, and attempt to log in.
If the application allows you to create an authenticated session using an
invented token, it is vulnerable to session fixation.
5. If the application does not support login, but processes sensitive user
information (such as personal and payment details), and allows this to be
displayed after submission (such as on a “verify my order” page), carry
out the previous three tests in relation to the pages displaying sensitive
data. If a token set during anonymous usage of the application can later
be used to retrieve sensitive user information, the application is vulnerable
to session fixation.
6. If the application uses HTTP cookies to transmit session tokens, it may
well be vulnerable to cross-site request forgery (XSRF). First, log in to the
application. Then confirm that a request made to the application but originating
from a page of a different application results in submission of the
user’s token. (This submission needs to be made from a window of the
same browser process that was used to log in to the target application.)
Attempt to identify any sensitive application functions whose parameters
an attacker can determine in advance, and exploit this to carry out unauthorized
actions within the security context of a target user. See Chapter
13 for more details on how to execute XSRF attacks.
Liberal Cookie Scope
The usual simple summary of how cookies work is that the server issues a cookie
using the HTTP response header Set-cookie, and the browser then resubmits
this cookie in subsequent requests to the same server using the Cookie header.
In fact, matters are rather more subtle than this.