the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 811
4.11.2 If the application generates account activation URLs that are distributed
out-of-band, try to register several new accounts in close succession,
and identify any sequence in the URLs you receive. If a pattern can
be determined, try to predict the URLs sent to recent and forthcoming
users, and attempt to use these URLs to take ownership of their
accounts.
4.11.3 Try to reuse a single activation URL multiple times, and see if the application
allows this. If it doesn’t, try locking out the target account before
reusing the URL, and see if the URL still works. Determine whether this
enables you to set a new password on an active account.
4.12 Test for Insecure Storage
4.12.1 If you gain access to hashed passwords, check for accounts that share
the same hashed password value. Try to log in with common passwords
for the most common hashed value.
4.12.2 Use an offline rainbow table for the hashing algorithm in question to
recover the cleartext value.
4.13 Test for Logic Flaws
4.13.1 Test for Fail-Open Conditions
4.13.1.1 For each function in which the application checks a user’s credentials,
including the login and password change functions, walk through the
process in the normal way, using an account you control. Note every
request parameter submitted to the application.
4.13.1.2 Repeat the process numerous times, modifying each parameter in turn
in various unexpected ways designed to interfere with the application’s
logic. For each parameter, include the following changes:
n Submit an empty string as the value.
n Remove the name/value pair.
n Submit very long and very short values.
n Submit strings instead of numbers, and vice versa.
n Submit the same named parameter multiple times, with the same
and different values.