the-web-application-hackers-handbook

836 Chapter 21 n A Web Application Hacker’s Methodology
7.7.3 If you find a remote file inclusion vulnerability, deploy a web server
containing a malicious script specific to the language you are targeting,
and use commands such as those used to test for script injection to verify
that your script is being executed.
8 Test for Function-Specific Input Vulnerabilities
In addition to the input-based attacks targeted in the preceding step, a range
of vulnerabilities normally manifest themselves only in particular kinds of
functionality. Before proceeding to the individual steps described in this section,
you should review your assessment of the application’s attack surface to
identify specific application functions where these defects are liable to arise,
and focus your testing on those.
Application mapping results
8.1. SMTP
injection
8.2. Native
code flaws
8.3. SOAP
injection
8.4. LDAP
injection
8.5. XPath
injection
8.6. Back-end
request
injection
8.7. XXE
injection
Figure 21-9: Testing for functionality-specific input vulnerabilities
8.1 Test for SMTP Injection
8.1.1 For each request employed in e-mail–related functionality, submit each
of the following test strings as each parameter in turn, inserting your
own e-mail address at the relevant position. You can use Burp Intruder
to automate this, as described in step 7.1 for general fuzzing. These test
strings already have special characters URL-encoded, so do not apply
any additional encoding to them.
%0aCc:
%0d%0aCc:
%0aBcc:
%0d%0aBcc:
%0aDATA%0afoo%0a%2e%0aMAIL+FROM:+%0aRCPT+TO:+