the-web-application-hackers-handbook

Chapter 20 n A Web Application Hacker’s Toolkit 771
active techniques. You can use the token analyzer tool to test the randomness
properties of session cookies and other tokens. And you can use the request
repeater to modify and reissue an individual request repeatedly to probe for
vulnerabilities or exploit bugs you have already discovered. Often you will pass
individual items back and forth between these different tools. For example,
you may select an interesting item from a fuzzing attack, or an issue reported
by the vulnerability scanner, and pass this to the request repeater to verify the
vulnerability or refine an exploit.
For many types of vulnerabilities, you will typically need to go back to your
browser to investigate an issue further, confirm whether an apparent vulnerability
is genuine, or test a working exploit. For example, having found a cross-site
scripting flaw using the vulnerability scanner or request repeater, you may paste
the resulting URL back into your browser to confirm that your proof-of-concept
exploit is executed. When testing possible access control bugs, you may view
the results of particular requests in your current browser session to confirm the
results within a specific user context. If you discover a SQL injection flaw that
can be used to extract large amounts of information, you might revert to your
browser as the most useful location to display the results.
You should not regard the work flow described here as in any way rigid or
restrictive. In many situations, you may test for bugs by entering unexpected
input directly into your browser or into the proxy interception window. Some
bugs may be immediately evident in requests and responses without the need to
involve any more attack-focused tools. You may bring in other tools for particular
purposes. You also may combine the components of the testing suite in innovative
ways that are not described here and maybe were not even envisioned by
the tool’s author. Integrated testing suites are hugely powerful creations, with
numerous interrelated features. The more creative you can be when using them,
the more likely you are to discover the most obscure vulnerabilities!
Alternatives to the Intercepting Proxy
One item that you should always have available in your toolkit is an alternative
to the usual proxy-based tools for the rare situations in which they cannot be
used. Such situations typically arise when you need to use some nonstandard
authentication method to access the application, either directly or via a corporate
proxy, or where the application uses an unusual client SSL certificate or browser
extension. In these cases, because an intercepting proxy interrupts the HTTP
connection between client and server, you may find that the tool prevents you
from using some or all of the application’s functionality.
The standard alternative approach in these situations is to use an in-browser
tool to monitor and manipulate the HTTP requests generated by your browser.
It remains the case that everything that occurs on the client, and all data submitted
to the server, is in principle under your full control. If you so desired,
you could write your own fully customized browser to perform any task you