the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 821
5.10.4 Determine any reliance on segregation by path, such as /site/main and
/site/demo, which can be subverted in the event of a cross-site scripting
attack.
5.10.5 Identify all the possible domain names and paths that will receive the
cookies that the application issues. Establish whether any other web
applications are accessible via these domain names or paths that you
may be able to leverage to capture the cookies issued to users of the
target application.
6 Test Access Controls
6.1. Understand the requirements
6.4. Test for
insecure methods
6.2. Test with
multiple accounts
6.3. Test with
limited access
Figure 21-7: Testing access controls
6.1 Understand the Access Control Requirements
6.1.1 Based on the core functionality implemented within the application,
understand the broad requirements for access control in terms of vertical
segregation (different levels of users have access to different types
of functionality) and horizontal segregation (users at the same privilege
level have access to different subsets of data). Often, both types of segregation
are present. For example, ordinary users may be able to access
their own data, while administrators can access everyone’s data.
6.1.2 Review your application mapping results to identify the areas of functionality
and types of data resources that represent the most fruitful
targets for privilege escalation attacks.
6.1.3 To perform the most effective testing for access control vulnerabilities,
you should ideally obtain a number of different accounts with different
vertical and horizontal privileges. If self-registration is possible, you can
probably obtain the latter directly from the application. To obtain the
former, you will probably need the cooperation of the application owner
(or need to exploit some vulnerability to gain access to a high-privileged
account). The availability of different kinds of accounts will affect the
types of testing you can perform, as described next.