the-web-application-hackers-handbook

812 Chapter 21 n A Web Application Hacker’s Methodology
4.13.1.3 Review closely the application’s responses to the preceding requests. If
any unexpected divergences from the base case occur, feed this observation
back into your framing of further test cases. If one modification
causes a change in behavior, try to combine this with other changes to
push the application’s logic to its limits.
4.13.2 Test Any Multistage Mechanisms
4.13.2.1 If any authentication-related function involves submitting credentials
in a series of different requests, identify the apparent purpose of each
distinct stage, and note the parameters submitted at each stage.
4.13.2.2 Repeat the process numerous times, modifying the sequence of requests
in ways designed to interfere with the application’s logic, including
the following tests:
n Proceed through all stages, but in a different sequence than the one
intended.
n Proceed directly to each stage in turn, and continue the normal
sequence from there.
n Proceed through the normal sequence several times, skipping each
stage in turn, and continuing the normal sequence from the next stage.
n On the basis of your observations and the apparent purpose of each
stage of the mechanism, try to think of further ways to modify the
sequence and to access the different stages that the developers may
not have anticipated.
4.13.2.3 Determine whether any single piece of information (such as the username)
is submitted at more than one stage, either because it is captured
more than once from the user or because it is transmitted via the client
in a hidden form field, cookie, or preset query string parameter. If so, try
submitting different values at different stages (both valid and invalid)
and observing the effect. Try to determine whether the submitted item
is sometimes superfluous, or is validated at one stage and then trusted
subsequently, or is validated at different stages against different checks.
Try to exploit the application’s behavior to gain unauthorized access
or reduce the effectiveness of the controls imposed by the mechanism.
4.13.2.4 Look for any data that is transmitted via the client that has not been
captured from the user at any point. If hidden parameters are used