the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 813
to track the state of the process across successive stages, it may be
possible to interfere with the application’s logic by modifying these
parameters in crafted ways.
4.13.2.5 If any part of the process involves the application’s presenting a randomly
varying challenge, test for two common defects:
n If a parameter specifying the challenge is submitted along with the
user’s response, determine whether you can effectively choose your
own challenge by modifying this value.
n Try proceeding as far as the varying challenge several times with
the same username, and determine whether a different challenge
is presented. If it is, you can effectively choose your own challenge
by proceeding to this stage repeatedly until your desired
challenge is presented.
4.14 Exploit Any Vulnerabilities to Gain
Unauthorized Access
4.14.1 Review any vulnerabilities you have identified within the various authentication
functions, and identify any that you can leverage to achieve
your objectives in attacking the application. This typically involves
attempting to authenticate as a different user — if possible, a user with
administrative privileges.
4.14.2 Before mounting any kind of automated attack, note any account
lockout defenses you have identified. For example, when performing
username enumeration against a login function, submit a common
password with each request rather than a completely arbitrary value
so as not to waste a failed login attempt on every username discovered.
Similarly, perform any password-guessing attacks on a breadth-first,
not depth-first, basis. Start your word list with the most common weak
passwords, and proceed through this list, trying each item against
every enumerated username.
4.14.3 Take account of the password quality rules and the completeness of
password validation when constructing word lists to use in any passwordguessing
attack to avoid impossible or superfluous test cases.
4.14.4 Use the techniques described in Chapter 14 to automate as much
work as possible and maximize the speed and effectiveness of your
attacks.