the-web-application-hackers-handbook

590 Chapter 14 n Automating Customized Attacks
SessionId ../../../../../../etc/passwd 302 502
SessionId xsstest 302 502
uid ‘ 200 2941 exception quotation
uid ;/bin/ls 200 2895 exception
uid ../../../../../../etc/passwd 200 2915 exception
uid xsstest 200 2898 exception xsstest
In requests that modify the SessionId parameter, the application responds
with a redirection response that always has the same length. This behavior does
not indicate any vulnerability. This is unsurprising, since modifying the session
token while logged in typically invalidates the current session and causes
a redirection to the login.
The uid parameter is more interesting. All the modifications to this parameter
cause a response containing the string exception. The responses are variable
in length, indicating that the different payloads result in different responses, so
this is probably not just a generic error message. Going further, we can see that
when a single quotation mark is submitted, the application’s response contains
the string quotation, which is likely to be part of a SQL error message. This
could be a SQL injection flaw, and we should manually investigate to confirm
this (see Chapter 9). In addition, we can see that the payload xsstest is being
echoed in the application’s response. We should probe this behavior further to
determine whether the error message can be leveraged to perform a cross-site
scripting attack (see Chapter 12).
TRY IT!
http://mdsec.net/auth/498/
Putting It All Together: Burp Intruder
The JAttack tool consists of fewer than 250 lines of simple code, yet in a few
seconds, it uncovered at least two potentially serious security vulnerabilities
while fuzzing a single request to an application.
Nevertheless, despite its power, as soon as you start to use a tool such as
JAttack to deliver automated customized attacks, you will quickly identify
additional functionality that would make it even more helpful. As it stands, you
need to configure every targeted request within the tool’s source code and then
recompile it. It would be better to read this information from a configuration
file and dynamically construct the attack at runtime. In fact, it would be much