the-web-application-hackers-handbook

392 Chapter 10 n Attacking Back-End Components
n An attacker may be able to use the proxy to connect back to other services
running on the application server itself, circumventing firewall restrictions
and potentially exploiting trust relationships to bypass authentication.
n Finally, the proxy functionality could be used to deliver attacks such as
cross-site scripting by causing the application to include attacker-controlled
content within its responses (see Chapter 12 for more details).
HACK STEPS
1. Identify any request parameters that appear to contain hostnames, IP
addresses, or full URLs.
2. For each parameter, modify its value to specify an alternative resource,
similar to the one being requested, and see if that resource appears in the
server’s response.
3. Try specifying a URL targeting a server on the Internet that you control,
and monitor that server for incoming connections from the application
you are testing.
4. If no incoming connection is received, monitor the time taken for the
application to respond. If there is a delay, the application’s back-end
requests may be timing out due to network restrictions on outbound
connections.
5. If you are successful in using the functionality to connect to arbitrary
URLs, try to perform the following attacks:
a. Determine whether the port number can be specified. For example,
you might supply http://mdattacker.net:22.
b. If successful, attempt to port-scan the internal network by using a tool
such as Burp Intruder to connect to a range of IP addresses and ports
in sequence (see Chapter 14).
c. Attempt to connect to other services on the loopback address of the
application server.
d. Attempt to load a web page that you control into the application’s
response to deliver a cross-site scripting attack.
NOTE Some server-side redirection APIs, such as Server.Transfer()
and Server.Execute() in ASP.NET, allow redirection only to relative URLs
on the same host. Functionality that passes user-supplied input to one of
these methods can still potentially be exploited to exploit trust relationships
and access resources on the server that are protected by platform-level
authentication.