the-web-application-hackers-handbook

Chapter 3 n Web Application Technologies 51
It is relatively rare to encounter these authentication protocols being used
by web applications deployed on the Internet. They are more commonly used
within organizations to access intranet-based services.
COMMON MYTH
“Basic authentication is insecure.”
Because basic authentication places credentials in unencrypted form within
the HTTP request, it is frequently stated that the protocol is insecure and
should not be used. But forms-based authentication, as used by numerous
banks, also places credentials in unencrypted form within the HTTP request.
Any HTTP message can be protected from eavesdropping attacks by using HTTPS
as a transport mechanism, which should be done by every security-conscious
application. In relation to eavesdropping, at least, basic authentication in itself
is no worse than the methods used by the majority of today’s web applications.
Web Functionality
In addition to the core communications protocol used to send messages between
client and server, web applications employ numerous technologies to deliver
their functionality. Any reasonably functional application may employ dozens
of distinct technologies within its server and client components. Before you can
mount a serious attack against a web application, you need a basic understanding
of how its functionality is implemented, how the technologies used are
designed to behave, and where their weak points are likely to lie.
Server-Side Functionality
The early World Wide Web contained entirely static content. Websites consisted
of various resources such as HTML pages and images, which were
simply loaded onto a web server and delivered to any user who requested
them. Each time a particular resource was requested, the server responded
with the same content.
Today’s web applications still typically employ a fair number of static resources.
However, a large amount of the content that they present to users is generated
dynamically. When a user requests a dynamic resource, the server’s response
is created on the fly, and each user may receive content that is uniquely customized
for him or her.
Dynamic content is generated by scripts or other code executing on the server.
These scripts are akin to computer programs in their own right. They have various
inputs, perform processing on these, and return their outputs to the user.