the-web-application-hackers-handbook

654 Chapter 17 n Attacking Application Architecture
Figure 17-4: Executing the session file containing the malicious nickname via the
local file inclusion function
HACK STEPS
1. As described throughout this book, for any vulnerability you identify
within the application, think imaginatively about how this can be
exploited to achieve your objectives. Countless successful hacks against
web applications begin from a vulnerability that is intrinsically limited
in its impact. By exploiting trust relationships and undercutting controls
implemented elsewhere within the application, it may be possible to
leverage a seemingly minor defect to carry out a serious breach.
2. If you succeed in performing arbitrary command execution on any component
of the application, and you can initiate network connections to other
hosts, consider ways of directly attacking other elements of the application’s
infrastructure at the network and operating system layers to expand
the scope of your compromise.
Securing Tiered Architectures
If carefully implemented, a multitiered architecture can considerably enhance
an application’s security, because it localizes the impact of a successful attack.
In the basic LAMP configuration described previously, in which all components
run on a single computer, the compromise of any tier is likely to lead
to complete compromise of the application. In a more secure architecture, the
compromise of one tier may result in partial control over an application’s data
and processing, but it may be more limited in its impact and perhaps contained
to the affected tier.
Minimize Trust Relationships
As far as possible, each tier should implement its own controls to defend against
unauthorized actions and should not trust other application components to