the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 851
or within HTML metatags), the page concerned may be cached by one
or more browsers:
Expires: 0
Cache-control: no-cache
Pragma: no-cache
12.2.4 Identify any instances within the application in which sensitive data is
transmitted via a URL parameter. If any cases exist, examine the browser
history to verify that this data has been stored there.
12.2.5 For all forms that are used to capture sensitive data from the user (such
as credit card details), review the form’s HTML source. If the attribute
autocomplete=off is not set, within either the form tag or the tag for the
individual input field, data entered is stored within browsers that support
autocomplete, provided that the user has not disabled this feature.
12.2.6 Check for technology-specific local storage.
12.2.6.1 Check for Flash local objects using the BetterPrivacy plug-in
for Firefox.
12.2.6.2 Check any Silverlight isolated storage in this directory:
C:\Users\{username}\AppData\LocalLow\Microsoft\
Silverlight\
12.2.6.3 Check any use of HTML5 local storage.
12.3 Check for Weak SSL Ciphers
12.3.1 If the application uses SSL for any of its communications, use the tool
THCSSLCheck to list the ciphers and protocols supported.
12.3.2 If any weak or obsolete ciphers and protocols are supported, a suitably
positioned attacker may be able to perform an attack to downgrade or
decipher the SSL communications of an application user, gaining access
to his sensitive data.
12.3.3 Some web servers advertise certain weak ciphers and protocols as supported
but refuse to actually complete a handshake using these if a
client requests them. This can lead to false positives when you use the
THCSSLCheck tool. You can use the Opera browser to attempt to perform
a complete handshake using specified weak protocols to confirm
whether these can actually be used to access the application.
12.4 Check Same-Origin Policy Configuration
12.4.1 Check for the /crossdomain.xml file. If the application allows unrestricted
access (by specifying ), Flash objects