the-web-application-hackers-handbook

850 Chapter 21 n A Web Application Hacker’s Methodology
and scripts contained within HTML pages (both static and dynamically
generated).
12.1.2 Identify all uses of the following APIs, which may be used to access
DOM data that can be controlled via a crafted URL:
document.location
document.URL
document.URLUnencoded
document.referrer
window.location
12.1.3 Trace the relevant data through the code to identify what actions are
performed with it. If the data (or a manipulated form of it) is passed to
one of the following APIs, the application may be vulnerable to XSS:
document.write()
document.writeln()
document.body.innerHtml
eval()
window.execScript()
window.setInterval()
window.setTimeout()
12.1.4 If the data is passed to one of the following APIs, the application may
be vulnerable to a redirection attack:
document.location
document.URL
document.open()
window.location.href
window.navigate()
window.open()
12.2 Check for Local Privacy Vulnerabilities
12.2.1 Review the logs created by your intercepting proxy to identify all the
Set-Cookie directives received from the application during your testing.
If any of these contains an expires attribute with a date that is in
the future, the cookie will be stored by users’ browsers until that date.
Review the contents of any persistent cookies for sensitive data.
12.2.2 If a persistent cookie is set that contains any sensitive data, a local attacker
may be able to capture this data. Even if the data is encrypted, an attacker
who captures it will be able to resubmit the cookie to the application
and gain access to any data or functionality that this allows.
12.2.3 If any application pages containing sensitive data are accessed over
HTTP, look for any cache directives within the server’s responses. If any
of the following directives do not exist (either within the HTTP headers