the-web-application-hackers-handbook

818 Chapter 21 n A Web Application Hacker’s Methodology
5.5.2 Identify any instances where session tokens are transmitted within the
URL. It may be that tokens are generally transmitted in a more secure
manner, but that developers have used the URL in specific cases to
work around a particular problem. If so, these may be transmitted in
the Referer header when users follow any off-site links. Check for any
functionality that enables you to inject arbitrary off-site links into pages
viewed by other users.
5.5.3 If you find any way to gather valid session tokens issued to other users,
look for a way to test each token to determine whether it belongs to an
administrative user (for example, by attempting to access a privileged
function using the token).
5.6 Check Mapping of Tokens to Sessions
5.6.1 Log in to the application twice using the same user account, either from
different browser processes or from different computers. Determine
whether both sessions remain active concurrently. If they do, the application
supports concurrent sessions, enabling an attacker who has
compromised another user’s credentials to use these without risk of
detection.
5.6.2 Log in and log out several times using the same user account, either from
different browser processes or from different computers. Determine
whether a new session token is issued each time, or whether the same
token is issued every time the same account logs in. If the latter occurs,
the application is not really employing proper session tokens, but is
using unique persistent strings to reidentify each user. In this situation,
there is no way to protect against concurrent logins or properly enforce
session timeout.
5.6.3 If tokens appear to contain any structure and meaning, attempt to separate
out components that may identify the user from those that appear to be
inscrutable. Try to modify any user-related components of the token so
that they refer to other known users of the application. Verify whether
the application accepts the resulting token and whether it enables you
to masquerade as that user. See Chapter 7 for examples of this kind of
subtle vulnerability.
5.7 Test Session Termination
5.7.1 When testing for session timeout and logout flaws, focus solely on the
server’s handling of sessions and tokens, rather than any events that occur
on the client. In terms of session termination, nothing much depends on
what happens to the token within the client browser.