the-web-application-hackers-handbook

424 Chapter 11 n Attacking Application Logic
wahh consulting “Press Release 08-03-2011” takeover ngs announced
>> 0 matches
wahh consulting “Press Release 08-03-2011” takeover ngs cancelled
>> 0 matches
wahh consulting “Press Release 08-03-2011” takeover ngs completed
>> 1 match
Although the user cannot view the document itself, with sufficient imagination
and use of scripted requests, he may be able to build a fairly accurate
understanding of its contents.
TIP In certain situations, being able to leach information via a search
function in this way may be critical to the security of the application itself,
effectively disclosing details of administrative functions, passwords, and technologies
in use.
TIP This technique has proven to be an effective attack against internal
document man agement software. The authors have used this technique to
brute-force a key password from a configuration file that was stored in a wiki.
Because the wiki returned a hit if the search string appeared anywhere in the
page (instead of matching on whole words), it was possible to brute-force the
password letter by letter, searching for the following:
Password=A
Password=B
Password=BA
...
Example 11: Snarfing Debug Messages
The authors encountered this logic flaw in a web application used by a financial
services company.
The Functionality
The application was only recently deployed. Like much new software, it still contained
a number of functionality-related bugs. Intermittently, various operations
would fail in an unpredictable way, and users would receive an error message.
To facilitate the investigation of errors, developers decided to include detailed,
verbose information in these messages, including the following details:
n The user’s identity
n The token for the current session
n The URL being accessed
n All the parameters supplied with the request that generated the error