the-web-application-hackers-handbook

Chapter 8 n Attacking Access Controls 277
HACK STEPS
1. Identify any parameters that follow Java naming conventions (for example,
get, set, add, update, is, or has followed by a capitalized word), or
explicitly specify a package structure (for example, com.companyname
.xxx.yyy.ClassName). Make a note of all referenced methods you can
find.
2. Look out for a method that lists the available interfaces or methods.
Check through your proxy history to see if it has been called as part of
the application’s normal communication. If not, try to guess it using the
observed naming convention.
3. Consult public resources such as search engines and forum sites to determine
any other methods that might be accessible.
4. Use the techniques described in Chapter 4 to guess other method names.
5. Attempt to access all methods gathered using a variety of user account
types, including unauthenticated access.
6. If you do not know the number or types of arguments expected by some
methods, look for methods that are less likely to take arguments, such as
listInterfaces and getAllUsersInRoles.
Testing Controls Over Static Resources
In cases where static resources that the application is protecting are ultimately
accessed directly via URLs to the resource files themselves, you should test
whether it is possible for unauthorized users to simply request these URLs directly.
HACK STEPS
1. Step through the normal process for gaining access to a protected static
resource to obtain an example of the URL by which it is ultimately
retrieved.
2. Using a different user context (for example, a less-privileged user or an
account that has not made a required purchase), attempt to access the
resource directly using the URL you have identified.
3. If this attack succeeds, try to understand the naming scheme being used
for protected static files. If possible, construct an automated attack to
trawl for content that may be useful or that may contain sensitive data
(see Chapter 14).