the-web-application-hackers-handbook

774 Chapter 20 n A Web Application Hacker’s Toolkit
Vulnerabilities Detected by Scanners
Several categories of common vulnerabilities can be detected by scanners with
a degree of reliability. These are vulnerabilities with a fairly standard signature.
In some cases, the signature exists within the application’s normal requests and
responses. In other cases, the scanner sends a crafted request designed to trigger
the signature if the vulnerability is present. If the signature appears in the
application’s response to the request, the scanner infers that the vulnerability
is present.
Here are some examples of vulnerabilities that can be detected in this way:
n Reflected cross-site scripting vulnerabilities arise when user-supplied input
is echoed in the application’s responses without appropriate sanitization.
Automated scanners typically send test strings containing HTML markup
and search the responses for these strings, enabling them to detect many
of these flaws.
n Some SQL injection vulnerabilities can be detected via a signature. For
example, submitting a single quotation mark may result in an ODBC error
message, or submitting the string ‘; waitfor delay ‘0:0:30’-- may
result in a time delay.
n Some path traversal vulnerabilities can be detected by submitting a traversal
sequence targeting a known file such as win.ini or /etc/passwd
and searching the response for the appearance of this file.
n Some command injection vulnerabilities can be detected by injecting a
command that causes a time delay or echoes a specific string into the
application’s response.
n Straightforward directory listings can be identified by requesting the
directory path and looking for a response containing text that looks like
a directory listing.
n Vulnerabilities such as cleartext password submission, liberally scoped
cookies, and forms with autocomplete enabled can be reliably detected
by reviewing the normal requests and responses the application makes.
n Items not linked from the main published content, such as backup files
and source files, can often be discovered by requesting each enumerated
resource with a different file extension.
In many of these cases, some instances of the same category of vulnerability
cannot be reliably detected using a standard attack string and signature. For
example, with many input-based vulnerabilities, the application implements some
rudimentary input validation that can be circumvented using crafted input. The
usual attack strings may be blocked or sanitized; however, a skilled attacker can
probe the input validation in place and discover a bypass to it. In other cases,