the-web-application-hackers-handbook

Chapter 15 n Exploiting Information Disclosure 627
computationally intensive operations to validate the supplied password
against a stored hash. If an attacker can detect this timing difference, he
may be able to exploit it to enumerate valid usernames.
n Some application functions may perform an action on the basis of user
input that times out if an item of submitted data is invalid. For example,
an application may use a cookie to store the address of a host located
behind a front-end load balancer. An attacker may be able to manipulate
this address to scan for web servers inside the organization’s internal
network. If the address of an actual server that is not part of the application
infrastructure is supplied, the application may immediately return
an error. If a nonexistent address is supplied, the application may time
out attempting to contact this address before returning the same generic
error. You can use the response timers within Burp Intruder’s results table
to facilitate this testing. Note that these columns are hidden by default,
but can be shown via the Columns menu.
HACK STEPS
1. Differences in the timing of application responses may be subtle and difficult
to detect. In a typical situation, it is worth probing the application for
this behavior only in selected key areas where a crucial item of interesting
data is submitted and where the kind of processing being performed is
likely to result in time differences.
2. To test a particular function, compile one list containing several items that
are known to be valid (or that have been accessed recently) and a second
list containing items that are known to be invalid (or dormant). Make
requests containing each item on these lists in a controlled way, issuing
only one request at a time, and monitoring the time taken for the application
to respond to each request. Determine whether there is any correlation
between the item’s status and the time taken to respond.
3. You can use Burp Intruder to automate this task. For every request it generates,
Intruder automatically records the time taken before the application
responds and the time taken to complete the response. You can sort
a table of results by either of these attributes to quickly identify any obvious
correlations.
Preventing Information Leakage
Although it may not be feasible or desirable to prevent the disclosure of absolutely
any information that an attacker may find useful, various relatively
straightforward measures can be taken to reduce information leakage to a