the-web-application-hackers-handbook

Chapter 10 n Attacking Back-End Components 401
should also test for each kind of attack, and you should perform each test case
using both Windows- and UNIX-style newline characters.
HACK STEPS
1. You should submit each of the following test strings as each parameter in
turn, inserting your own e-mail address at the relevant position:
%0aCc:
%0d%0aCc:
%0aBcc:
%0d%0aBcc:
%0aDATA%0afoo%0a%2e%0aMAIL+FROM:+%0aRCPT+TO:+%0aDATA%0aFrom:+%0aTo:+%0aS
ubject:+test%0afoo%0a%2e%0a
%0d%0aDATA%0d%0afoo%0d%0a%2e%0d%0aMAIL+FROM:+%0
d%0aRCPT+TO:+%0d%0aDATA%0d%0aFrom:+%
0d%0aTo:+%0d%0aSubject:+test%0d%0
afoo%0d%0a%2e%0d%0a
2. Note any error messages the application returns. If these appear to relate
to any problem in the e-mail function, investigate whether you need to
fine-tune your input to exploit a vulnerability.
3. The application’s responses may not indicate in any way whether a vulnerability
exists or was successfully exploited. You should monitor the
e-mail address you specified to see if any mail is received.
4. Review closely the HTML form that generates the relevant request. This
may contain clues about the server-side software being used. It may also
contain a hidden or disabled field that specifies the e-mail’s To address,
which you can modify directly.
TIP Functions to send e-mails to application support personnel are frequently
regarded as peripheral and may not be subject to the same security
standards or testing as the main application functionality. Also, because they
involve interfacing to an unusual back-end component, they are often implemented
via a direct call to the relevant operating system command. Hence,
in addition to probing for SMTP injection, you should also closely review all
e-mail-related functionality for OS command injection flaws.