the-web-application-hackers-handbook

708 Chapter 19 n Finding Vulnerabilities in Source Code
checks whether the redirection URL contains a double slash (as in http://). If it
does, the script skips past the double slash to the first single slash, thereby converting
it into a relative URL. However, the script then makes a final call to the
unescape() function, which unpacks any URL-encoded characters. Performing
canonicalization after validation often leads to a vulnerability (see Chapter 2).
In this instance an attacker can cause a redirect to an arbitrary absolute URL
with the following query string:
?redir=http:%25252f%25252fwahh-attacker.com
OS Command Injection
Code that interfaces with external systems often contains signatures indicating
code injection flaws. In the following example, the message and address
parameters have been extracted from user-controllable form data and are passed
directly into a call to the UNIX system API:
void send_mail(const char *message, const char *addr)
{
char sendMailCmd[4096];
snprintf(sendMailCmd, 4096, “echo ‘%s’ | sendmail %s”, message, addr);
system(sendMailCmd);
return;
}
Backdoor Passwords
Unless they have been deliberately concealed by a malicious programmer,
backdoor passwords that have been used for testing or administrative purposes
usually stand out when you review credential validation logic. For example:
private UserProfile validateUser(String username, String password)
{
UserProfile up = getUserProfile(username);
if (checkCredentials(up, password) ||
“oculiomnium”.equals(password))
return up;
}
return null;
Other items that may be easily identified in this way include unreferenced
functions and hidden debug parameters.