the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 829
n If you can cause different application responses based on a single
arbitrary condition, use Absinthe to extract arbitrary data one bit
at a time.
n If you can trigger time delays based on a single arbitrary condition,
exploit these to retrieve data one bit at a time.
n If the application is blocking certain characters or expressions that
you require to perform a particular attack, try the various bypass
techniques described in Chapter 9 to circumvent the input filter.
n If possible, escalate the attack against the database and the underlying
server by leveraging any vulnerabilities or powerful functions
within the database.
7.3 Test for XSS and Other Response Injection
7.3.1 Identify Reflected Request Parameters
7.3.1.1 Sort the results of your fuzz testing by clicking the Payload Grep column,
and identify any matches corresponding to the XSS payloads listed in
step 7.1.3. These are cases where the XSS test strings were returned
unmodified within the application’s responses.
7.3.1.2 For each of these cases, review the application’s response to find the location
of the supplied input. If this appears within the response body, test
for XSS vulnerabilities. If the input appears within any HTTP header, test
for header injection vulnerabilities. If it is used in the Location header
of a 302 response, or if it is used to specify a redirect in some other way,
test for redirection vulnerabilities. Note that the same input might be
copied into multiple locations within the response, and that more than
one type of reflected vulnerability might be present.
7.3.2 Test for Reflected XSS
7.3.2.1 For each place within the response body where the value of the request
parameter appears, review the surrounding HTML to identify possible
ways of crafting your input to cause execution of arbitrary JavaScript.
For example, you can inject tags, inject into an existing script,
or place a crafted value into a tag attribute.
7.3.2.2 Use the different methods of beating signature-based filters described in
Chapter 12 as a reference for the different ways in which crafted input
can be used to cause execution of JavaScript.
7.3.2.3 Try submitting various possible exploits to the application, and monitor
its responses to determine whether any filtering or sanitization of input