the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 801
3.1 Test Transmission of Data Via the Client
3.1.1 Locate all instances within the application where hidden form fields,
cookies, and URL parameters are apparently being used to transmit
data via the client.
3.1.2 Attempt to determine the purpose that the item plays in the application’s
logic, based on the context in which it appears and on its name
and value.
3.1.3 Modify the item’s value in ways that are relevant to its role in the
application’s functionality. Determine whether the application processes
arbitrary values submitted in the field and whether this fact
can be exploited to interfere with the application’s logic or subvert
any security controls.
3.1.4 If the application transmits opaque data via the client, you can attack this
in various ways. If the item is obfuscated, you may be able to decipher
the obfuscation algorithm and therefore submit arbitrary data within the
opaque item. Even if it is securely encrypted, you may be able to replay
the item in other contexts to interfere with the application’s logic. See
Chapter 5 for more details on these and other attacks.
3.1.5 If the application uses the ASP.NET ViewState, test to confirm whether
this can be tampered with or whether it contains any sensitive information.
Note that the ViewState may be used differently on different
application pages.
3.1.5.1 Use the ViewState analyzer in Burp Suite to confirm whether
the EnableViewStateMac option has been enabled, meaning
that the ViewState’s contents cannot be modified.
3.1.5.2 Review the decoded ViewState to identify any sensitive data it
contains.
3.1.5.3 Modify one of the decoded parameter values and reencode and
submit the ViewState. If the application accepts the modified
value, you should treat the ViewState as an input channel for
introducing arbitrary data into the application’s processing.
Perform the same testing on the data it contains as you would
for any other request parameters.
3.2 Test Client-Side Controls Over User Input
3.2.1 Identify any cases where client-side controls such as length limits and
JavaScript checks are used to validate user input before it is submitted