the-web-application-hackers-handbook

588 Chapter 14 n Automating Customized Attacks
n ../../../../../etc/passwd — This string causes a different response
in some cases where a path traversal flaw exists.
n xsstest — If this string is copied into the server’s response, the application
may be vulnerable to cross-site scripting.
We can extend the JAttack tool to generate these payloads by creating a new
payload source:
class PSFuzzStrings implements PayloadSource
{
static final String[] fuzzStrings = new String[]
{
“’”, “;/bin/ls”, “../../../../../etc/passwd”, “xsstest”
};
int current = -1;
public boolean nextPayload()
{
current++;
return current < fuzzStrings.length;
}
public void reset()
{
current = -1;
}
}
public String getPayload()
{
return fuzzStrings[current];
}
NOTE Any serious attack to probe the application for security flaws would
need to employ many other attack strings to identify other weaknesses and
other variations on the defects previously mentioned. See Chapter 21 for a
more comprehensive list of the strings that are effective when fuzzing a web
application.
To use JAttack for fuzzing, we also need to extend its response analysis code
to provide more information about each response received from the application.
A simple way to greatly enhance this analysis is to search each response
for a number of common strings and error messages that may indicate that
some anomalous behavior has occurred, and record any appearance within
the tool’s output.