the-web-application-hackers-handbook

594 Chapter 14 n Automating Customized Attacks
Burp Intruder by default URL-encodes any characters that might invalidate
your request if placed into the request in their literal form.
Configuring Response Analysis
For many kinds of attacks, you should identify the attributes of the server’s
responses that you are interested in analyzing. For example, when enumerating
identifiers, you may need to search each response for a specific string. When
fuzzing, you may want to scan for a large number of common error messages
and the like.
By default, Burp Intruder records in its table of results the HTTP status code,
the response length, any cookies set by the server, and the time taken to receive
the response. As with JAttack, you can additionally configure Burp Intruder to
perform some custom analysis of the application’s responses to help identify
interesting cases that may indicate the presence of a vulnerability or merit further
investigation. You can specify strings or regex expressions that responses
will be searched for. You can set customized strings to control extraction of data
from the server’s responses. And you can make Intruder check whether each
response contains the attack payload itself to help identify cross-site scripting
and other response injection vulnerabilities. These settings can be configured
before each attack is launched and can also be applied to the attack results after
the attack has started.
Having configured payload positions, payload sources, and any required
analysis of server responses, you are ready to launch your attack. Let’s take a
quick look at how Intruder can be used to deliver some common customized
automated attacks.
Attack 1: Enumerating Identifiers
Suppose that you are targeting an application that supports self-registration for
anonymous users. You create an account, log in, and gain access to a minimum
of functionality. At this stage, one area of obvious interest is the application’s
session tokens. Logging in several times in close succession generates the following
sequence:
000000-fb2200-16cb12-172ba72551
000000-bc7192-16cb12-172ba7279e
000000-73091f-16cb12-172ba729e8
000000-918cb1-16cb12-172ba72a2a
000000-aa820f-16cb12-172ba72b58
000000-bc8710-16cb12-172ba72e2b