the-web-application-hackers-handbook

Chapter 19 n Finding Vulnerabilities in Source Code 707
}
return bAttachment;
You should closely review any application functionality that enables users
to upload or download files. You need to understand how filesystem APIs
are being invoked in response to user-supplied data and determine whether
crafted input can be used to access files in an unintended location. Often, you
can quickly identify relevant functionality by searching the codebase for the
names of any query string parameters that relate to filenames (AttachName in the
current example). You also can search for all file APIs in the relevant language
and review the parameters passed to them. (See later sections for listings of the
relevant APIs in common languages.)
Arbitrary Redirection
Various phishing vectors such as arbitrary redirects are often easy to spot
through signatures in the source code. In this example, user-supplied data from
the query string is used to construct a URL to which the user is redirected:
private void handleCancel()
{
httpResponse.Redirect(HttpUtility.UrlDecode(Request.QueryString[
“refURL”]) + “&SiteCode=” +
Request.QueryString[“SiteCode”].ToString() +
“&UserId=” + Request.QueryString[“UserId”].ToString());
}
Often, you can find arbitrary redirects by inspecting client-side code, which
of course does not require any special access to the application’s internals.
Here, JavaScript is used to extract a parameter from the URL query string and
ultimately redirect to it:
url = document.URL;
index = url.indexOf(‘?redir=’);
target = unescape(url.substring(index + 7, url.length));
target = unescape(target);
if ((index = target.indexOf(‘//’)) > 0) {
target = target.substring (index + 2, target.length);
index = target.indexOf(‘/’);
target = target.substring(index, target.length);
}
target = unescape(target);
document.location = target;
As you can see, the author of this script knew the script was a potential target
for redirection attacks to an absolute URL on an external domain. The script