the-web-application-hackers-handbook

Chapter 14 n Automating Customized Attacks 603
n While you are testing a request, the application terminates the session
being used for testing, either defensively or for other reasons, and the
remainder of the testing exercise is ineffective.
n An application function employs a changing token that must be supplied
with each request (for example, to prevent request forgery attacks).
n The request being tested appears within a multistage process. The request
is handled properly only if a series of other requests have first been made
to get the application into a suitable state.
Obstacles of this kind can always be circumvented in principle by refining
your automation techniques to work with whatever mechanisms the application
is using. If you are writing your own testing code along the lines of
JAttack, you can directly implement support for specific token-handling or
multistage mechanisms. However, this approach can be complex and does
not scale very well to large applications. In practice, the need to write new
custom code to deal with each new instance of a problem may itself present a
significant barrier to using automation, and you may find yourself reverting
to slower manual techniques.
Session-Handling Support in Burp Suite
Fortunately, Burp Suite provides a range of features to handle all these situations
in as painless a manner as possible, allowing you to continue your testing while
Burp deals with the obstacles seamlessly in the background. These features are
based on the following components:
n Cookie jar
n Request macros
n Session-handling rules
We will briefly describe how these features can be combined to overcome
barriers to automation and allow you to continue testing in the various situations
described. More detailed help is available in the Burp Suite online
documentation.
Cookie Jar
Burp Suite maintains its own cookie jar, which tracks application cookies used
by your browser and by Burp’s own tools. You can configure how Burp automatically
updates the cookie jar, and you also can view and edit its contents
directly, as shown in Figure 14-10.