the-web-application-hackers-handbook

Chapter 10 n Attacking Back-End Components 383
HACK STEPS
To test for remote file inclusion flaws, follow these steps:
1. Submit in each targeted parameter a URL for a resource on a web server
that you control, and determine whether any requests are received from
the server hosting the target application.
2. If the first test fails, try submitting a URL containing a nonexistent IP
address, and determine whether a timeout occurs while the server
attempts to connect.
3. If the application is found to be vulnerable to remote file inclusion, construct
a malicious script using the available APIs in the relevant language,
as described for dynamic execution attacks.
Local file inclusion vulnerabilities can potentially exist in a much wider
range of scripting environments than those that support remote file inclusion.
To test for local file inclusion vulnerabilities, follow these steps:
1. Submit the name of a known executable resource on the server, and
determine whether any change occurs in the application’s behavior.
2. Submit the name of a known static resource on the server, and determine
whether its contents are copied into the application’s response.
3. If the application is vulnerable to local file inclusion, attempt to access
any sensitive functionality or resources that you cannot reach directly via
the web server.
4. Test to see if you can access files in other directories using the traversal
techniques described previously.
Injecting into XML Interpreters
XML is used extensively in today’s web applications, both in requests and
responses between the browser and front-end application server and in messages
between back-end application components such as SOAP services. Both
of these locations are susceptible to attacks whereby crafted input is used to
interfere with the operation of the application and normally perform some
unauthorized action.