the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 793
the following thought in mind: the tasks we describe are largely standard and
orthodox; the most impressive attacks against web applications always involve
thinking beyond them.
General Guidelines
You should always keep in mind some general considerations when carrying out
the detailed tasks involved in attacking a web application. These may apply to all
the different areas you need to examine and techniques you need to carry out.
n Remember that several characters have special meaning in different parts
of the HTTP request. When you are modifying the data within requests,
you should URL-encode these characters to ensure that they are interpreted
in the way you intend:
n & is used to separate parameters in the URL query string and message
body. To insert a literal & character, you should encode this as %26.
n = is used to separate the name and value of each parameter in the URL
query string and message body. To insert a literal = character, you
should encode this as %3d.
n ? is used to mark the beginning of the URL query string. To insert a
literal ? character, you should encode this as %3f.
n A space is used to mark the end of the URL in the first line of requests
and can indicate the end of a cookie value in the Cookie header. To
insert a literal space, you should encode this as %20 or +.
n Because + represents an encoded space, to insert a literal + character,
you should encode this as %2b.
n ; is used to separate individual cookies in the Cookie header. To insert
a literal ; character, you should encode this as %3b.
n # is used to mark the fragment identifier within the URL. If you enter
this character into the URL within your browser, it effectively truncates
the URL that is sent to the server. To insert a literal # character, you
should encode this as %23.
n % is used as the prefix in the URL-encoding scheme. To insert a literal
% character, you should encode this as %25.
n Any nonprinting characters such as null bytes and newlines must, of
course, be URL-encoded using their ASCII character code — in this
case, as %00 and %0a, respectively.
n Furthermore, note that entering URL-encoded data into a form usually
causes your browser to perform another layer of encoding. For example,