the-web-application-hackers-handbook

548 Chapter 13 n Attacking Users: Other Techniques
This functionality allows applications to store commonly used data on the
client side and retrieve this quickly into the user interface when required. It also
allows applications to work in “offline mode,” in which all data processed by
the application resides on the client, and user actions are stored on the client for
later synchronization with the server, when a network connection is available.
Chapter 9 described how SQL injection attacks into server-side SQL databases
can arise, where attacker-controlled data is inserted into a SQL query in an
unsafe way. Exactly the same attack can arise on the client side. Here are some
scenarios in which this may be possible:
n Social networking applications that store details of the user’s contacts in
the local database, including contact names and status updates
n News applications that store articles and user comments in the local
database for offline viewing
n Web mail applications that store e-mail messages in the local database
and, when running in offline mode, store outgoing messages for later
sending
In these situations, an attacker may be able to perform client-side SQL injection
attacks by including crafted input in a piece of data he controls, which the
application stores locally. For example, sending an e-mail containing a SQL
injection attack in the subject line might compromise the local database of the
recipient user, if this data is embedded within a client-side SQL query. Depending
on exactly how the application uses the local database, serious attacks may be
possible. Using only SQL injection, an attacker may be able to retrieve from the
database the contents of other messages the user has received, copy this data
into a new outgoing e-mail to the attacker, and add this e-mail to the table of
queued outgoing messages.
The types of data that are often stored in client-side databases are likely to
include SQL metacharacters such as the single quotation mark. Therefore, many
SQL injection vulnerabilities are likely to be identified during normal usability
testing, so defenses against SQL injection attacks may be in place. As with
server-side injection, these defenses may contain various bypasses that can be
used to still deliver a successful attack.
Client-Side HTTP Parameter Pollution
Chapter 9 described how HTTP parameter pollution attacks can be used in some
situations to interfere with server-side application logic. In some situations, these
attacks may also be possible on the client side.
Suppose that a web mail application loads the inbox using the following URL:
https://wahh-mail.com/show?folder=inbox&order=down&size=20&start=1