the-web-application-hackers-handbook

Chapter 20 n A Web Application Hacker’s Toolkit 777
submitted. It doesn’t know that one of these parameters signifies a quantity
and another signifies a price. Furthermore, it doesn’t know that being able to
modify an order’s quantity is inconsequential, whereas being able to modify
its price represents a security flaw.
Scanners Do Not Improvise
Many web applications use nonstandard mechanisms to handle sessions and
navigation and to transmit and handle data, such as in the structure of the
query string, cookies, or other parameters. A human being may quickly notice
and deconstruct the unusual mechanism, but a computer will continue following
the standard rules it has been given. Furthermore, many attacks against
web applications require some improvisation, such as to circumvent partially
effective input filters or to exploit several different aspects of the application’s
behavior that collectively leave it open to attack. Scanners typically miss these
kinds of attacks.
Scanners Are Not Intuitive
Computers do not have intuition about how best to proceed. The approach of
today’s scanners is largely to attempt every attack against every function. This
imposes a practical limit on the variety of checks that can be performed and the
ways in which these can be combined. This approach overlooks vulnerabilities
in many cases:
n Some attacks involve submitting crafted input at one or more steps of a
multistage process and walking through the rest of the process to observe
the results.
n Some attacks involve changing the sequence of steps in which the application
expects a process to be performed.
n Some attacks involve changing the value of multiple parameters in crafted
ways. For example, an XSS attack may require a specific value to be placed
into one parameter to cause an error message, and an XSS payload to be
placed into another parameter, which is copied into the error message.
Because of the practical constraints imposed on scanners’ brute-force approach
to vulnerability detection, they cannot work through every permutation of
attack string in different parameters, or every permutation of functional steps.
Of course, no human being can do this practically either. However, a human
frequently has a feel for where the bugs are located, where the developer made
assumptions, and where something doesn’t “look right.” Hence, a human tester
will select a tiny proportion of the total possible attacks for actual investigation
and thereby will often achieve success.