the-web-application-hackers-handbook

808 Chapter 21 n A Web Application Hacker’s Methodology
4.5.4 If the function uses a password hint, perform the same exercise to harvest
a list of password hints, and identify any that appear to be easily
guessable.
4.5.5 Perform the same tests on any account-recovery challenges that you performed
at the main login function to assess vulnerability to automated
guessing attacks.
4.5.6 If the function involves sending an e-mail to the user to complete the
recovery process, look for any weaknesses that may enable you to take
control of other users’ accounts. Determine whether it is possible to
control the address to which the e-mail is sent. If the message contains
a unique recovery URL, obtain a number of messages using an e-mail
address you control, and attempt to identify any patterns that may enable
you to predict the URLs issued to other users. Apply the methodology
described in step 5.3 to identify any predictable sequences.
4.6 Test Any Remember Me Function
4.6.1 If the main login function or its supporting logic contains a Remember
Me function, activate this and review its effects. If this function allows the
user to log in on subsequent occasions without entering any credentials,
you should review it closely for any vulnerabilities.
4.6.2 Closely inspect all persistent cookies that are set when the Remember Me
function is activated. Look for any data that identifies the user explicitly
or appears to contain some predictable identifier of the user.
4.6.3 Even where the data stored appears to be heavily encoded or obfuscated,
review this closely, and compare the results of remembering several very
similar usernames and/or passwords to identify any opportunities to
reverse-engineer the original data. Apply the methodology described
in step 5.2 to identify any meaningful data.
4.6.4 Depending on your results, modify the contents of your cookie in suitable
ways in an attempt to masquerade as other users of the application.
4.7 Test Any Impersonation Function
4.7.1 If the application contains any explicit functionality that allows one
user to impersonate another, review this closely for any vulnerabilities
that may enable you to impersonate arbitrary users without proper
authorization.
4.7.2 Look for any user-supplied data that is used to determine the target
of the impersonation. Attempt to manipulate this to impersonate