the-web-application-hackers-handbook

804 Chapter 21 n A Web Application Hacker’s Methodology
encountering numerous errors. For these applications it is generally
quicker to attach a runtime debugger to the process. JavaSnoop does this
very well for Java. Silverlight Spy is a freely available tool that allows
runtime monitoring of Silverlight clients.
3.3.3.2 Locate the key functions and values the application employs to drive
security-related business logic, and place breakpoints when the targeted
function is called. Modify the arguments or return value as needed to
affect the security bypass.
3.3.4 Test ActiveX controls
3.3.4.1 Identify any ActiveX controls employed by the application. Look for
any .cab file types being requested via your intercepting proxy, or look
for object tags within the HTML source code of application pages. For
example:
3.3.4.2 It is usually possible to subvert any input validation performed within
an ActiveX control by attaching a debugger to the process and directly
modifying data being processed or altering the program’s execution
path. See Chapter 5 for more details about this kind of attack.
3.3.4.3 It is often possible to guess the purpose of different methods that an
ActiveX control exports based on their names and the parameters
passed to them. Use the COMRaider tool to enumerate the methods
exported by the control. Test whether any of these can be manipulated
to affect the control’s behavior and defeat any validation tests
it implements.
3.3.4.4 If the control’s purpose is to gather or verify certain information about
the client computer, use the Filemon and Regmon tools to monitor the
information the control gathers. It is often possible to create suitable
items within the system registry and filesystem to fix the inputs used
by the control and therefore affect its behavior.
3.3.4.5 Test any ActiveX controls for vulnerabilities that could be exploited to
attack other users of the application. You can modify the HTML used
to invoke a control to pass arbitrary data to its methods and monitor
the results. Look for methods with dangerous-sounding names, such
as LaunchExe. You can also use COMRaider to perform some basic fuzz
testing of ActiveX controls to identify flaws such as buffer overflows.