the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 849
these is by definition impossible, avoid using /etc/passwd or /windows/
system32/config/sam as payloads for file retrieval. Also avoid using
terms such as in an XSS attack and using alert() or xss as
XSS payloads.
11.7.5 If a particular request is blocked, try submitting the same parameter in a
different location or context. For instance, submit the same parameter in
the URL in a GET request, within the body of a POST request, and within
the URL in a POST request.
11.7.6 On ASP.NET, also try submitting the parameter as a cookie. The API
Request.Params[“foo”] will retrieve the value of a cookie named foo
if the parameter foo is not found in the query string or message body.
11.7.7 Review all the other methods of introducing user input provided in
Chapter 4, picking any that are not protected.
11.7.8 Determine locations where user input is (or can be) submitted in a nonstandard
format such as serialization or encoding. If none is available,
build the attack string by concatenation and/or by spanning it across
multiple variables. (Note that if the target is ASP.NET, you may be able
to use HPP to concatenate the attack using multiple specifications of the
same variable.)
12 Miscellaneous Checks
12.1. Test for DOM-based attacks
12.2. Test for local privacy vulnerabilities
12.3. Test for weak SSL ciphers
12.4. Check same-orgin policy configuration
Figure 21-13: Miscellaneous checks
12.1 Check for DOM-Based Attacks
12.1.1 Perform a brief code review of every piece of JavaScript received from
the application. Identify any XSS or redirection vulnerabilities that can
be triggered by using a crafted URL to introduce malicious data into
the DOM of the relevant page. Include all standalone JavaScript files