the-web-application-hackers-handbook

Chapter 20 n A Web Application Hacker’s Toolkit 779
It is fair to say that some of today’s scanners do a reasonable job of working
with the majority of authentication and session-handling mechanisms that are
in use. However, there remain numerous cases where scanners struggle. As
a result, they may fail to properly crawl or scan key parts of an application’s
attack surface. Because of the fully automated way in which standalone scanners
operate, this failure normally is not apparent to the user.
Dangerous Effects
In many applications, running an unrestricted automated scan without any user
guidance may be quite dangerous to the application and the data it contains.
For example, a scanner may discover an administration page that contains
functions to reset user passwords, delete accounts, and so on. If the scanner
blindly requests every function, this may result in access being denied to all
users of the application. Similarly, the scanner may discover a vulnerability
that can be exploited to seriously corrupt the data held within the application.
For example, in some SQL injection vulnerabilities, submitting standard SQL
attack strings such as or 1=1-- causes unforeseen operations to be performed
on the application’s data. A human being who understands the purpose of a
particular function may proceed with caution for this reason, but an automated
scanner lacks this understanding.
Individuating Functionality
There are many situations in which a purely syntactic analysis of an application
fails to correctly identify its core set of individual functions:
n Some applications contain a colossal quantity of content that embodies
the same core set of functionality. For example, applications such as eBay,
MySpace, and Amazon contain millions of different application pages
with different URLs and content, yet these correspond to a relatively small
number of actual application functions.
n Some applications may have no finite boundary when analyzed from a
purely syntactic perspective. For example, a calendar application may
allow users to navigate to any date. Similarly, some applications with a
finite amount of content employ volatile URLs or request parameters to
access the same content on different occasions, leading scanners to continue
mapping indefinitely.
n The scanner’s own actions may result in the appearance of seemingly new
content. For example, submitting a form may cause a new link to appear
in the application’s interface, and accessing the link may retrieve a further
form that has the same behavior.