the-web-application-hackers-handbook

826 Chapter 21 n A Web Application Hacker’s Methodology
meaning within HTTP requests. By default, Burp Intruder performs the
necessary encoding of these characters, so ensure that this option has not
been disabled. (To restore all options to their defaults following earlier
customization, select Burp ‚ Restore Defaults.)
7.1.5 In the Grep function of Burp Intruder, configure a suitable set of strings
to flag some common error messages within responses. For example:
error
exception
illegal
invalid
fail
stack
access
directory
file
not found
varchar
ODBC
SQL
SELECT
111111
Note that the string 111111 is included to test for successful script injection
attacks. The payloads in step 7.1.3 involve writing this value into
the server’s response.
7.1.6 Also select the Payload Grep option to flag responses that contain the
payload itself, indicating a potential XSS or header injection vulnerability.
7.1.7 Set up a web server or netcat listener on the host you specified in the
first file inclusion payload. This helps you monitor for connection
attempts received from the server resulting from a successful remote
file inclusion attack.
7.1.8 Launch the attack. When it has completed, review the results for anomalous
responses indicating the presence of vulnerabilities. Check for
divergences in the HTTP status code, the response length, the response
time, the appearance of your configured expressions, and the appearance
of the payload itself. You can click each column heading in the results
table to sort the results by the values in that column (and Shift-click
to reverse-sort the results). This enables you to quickly identify any
anomalies that stand out from the other results.
7.1.9 For each potential vulnerability indicated by the results of your fuzz testing,
refer to the following sections of this methodology. They describe
the detailed steps you should take in relation to each category of problem
to verify the existence of a vulnerability and successfully exploit it.