the-web-application-hackers-handbook

550 Chapter 13 n Attacking Users: Other Techniques
is performed when the user attempts to read a message, and a further action is
performed when the user attempts to return to the inbox.
Local Privacy Attacks
Many users access web applications from a shared environment in which an
attacker may have direct access to the same computer as the user. This gives
rise to a range of attacks to which insecure applications may leave their users
vulnerable. This kind of attack may arise in several areas.
NOTE Numerous mechanisms exist by which applications may store
potentially sensitive data on users’ computers. In many cases, to test
whether this is being done, it is preferable to start with a completely clean
browser so that data stored by the application being tested is not lost in
the noise of existing stored data. An ideal way to do this is using a virtual
machine with a clean installation of both the operating system and any
browsers.
Furthermore, on some operating systems, the folders and files containing
locally stored data may be hidden by default when using the built-in file system
explorer. To ensure that all relevant data is identified, you should configure
your computer to show all hidden and operating system files.
Persistent Cookies
Some applications store sensitive data in a persistent cookie, which most browsers
save on the local file system.
HACK STEPS
1. Review all the cookies identified during your application mapping exercises
(see Chapter 4). If any Set-cookie instruction contains an expires
attribute with a date that is in the future, this will cause the browser to
persist that cookie until that date. For example:
UID=d475dfc6eccca72d0e expires=Fri, 10-Aug-18 16:08:29 GMT;
2. If a persistent cookie is set that contains any sensitive data, a local
attacker may be able to capture this data. Even if a persistent cookie contains
an encrypted value, if this plays a critical role such as reauthenticating
the user without entering credentials, an attacker who captures it can
resubmit it to the application without actually deciphering its contents
(see Chapter 6).