the-web-application-hackers-handbook

574 Chapter 14 n Automating Customized Attacks
The Basic Approach
Your first task in formulating a customized automated attack to enumerate
valid identifiers is to locate a request/response pair that has the following
characteristics:
n The request includes a parameter containing the identifier you are targeting.
For example, in a function that displays an application page, the
request might contain the parameter PageNo=10069.
n The server’s response to this request varies in a systematic way when you
vary the parameter’s value. For example, if a valid PageNo is requested,
the server might return a response containing the specified document’s
contents. If an invalid value is requested, it might return a generic error
message.
Having located a suitable request/response pair, the basic approach involves
submitting a large number of automated requests to the application, either working
through a list of potential identifiers, or iterating through the syntactic range
of identifiers known to be in use. The application’s responses to these requests
are monitored for “hits,” indicating that a valid identifier was submitted.
Detecting Hits
There are numerous attributes of responses in which systematic variations may
be detected, and which may therefore provide the basis for an automated attack.
HTTP Status Code
Many applications return different status codes in a systematic way, depending
on the values of submitted parameters. The values that are most commonly
encountered during an attack to enumerate identifiers are as follows:
n 200 — The default status code, meaning “OK.”
n 301 or 302 — A redirection to a different URL.
n 401 or 403 — The request was not authorized or allowed.
n 404 — The requested resource was not found.
n 500 — The server encountered an error when processing the request.
Response Length
It is common for dynamic application pages to construct responses using a page
template (which has a fixed length) and to insert per-response content into this
template. If the per-response content does not exist or is invalid (such as if an
incorrect document ID was requested), the application might simply return an