the-web-application-hackers-handbook

36 Chapter 2 n Core Defense Mechanisms
Figure 2-8: An administrative interface within a web application
Summary
Despite their extensive differences, virtually all web applications employ the
same core security mechanisms in some shape or form. These mechanisms represent
an application’s primary defenses against malicious users and therefore
also comprise the bulk of the application’s attack surface. The vulnerabilities
we will examine later in this book mainly arise from defects within these core
mechanisms.
Of these components, the mechanisms for handling user access and user input
are the most important and should receive most of your attention when you are
targeting an application. Defects in these mechanisms often lead to complete
compromise of the application, enabling you to access data belonging to other
users, perform unauthorized actions, and inject arbitrary code and commands.
Questions
Answers can be found at http://mdsec.net/wahh.
1. Why are an application’s mechanisms for handling user access only as
strong as the weakest of these components?
2. What is the difference between a session and a session token?
3. Why is it not always possible to use a whitelist-based approach to input
validation?