the-web-application-hackers-handbook

852 Chapter 21 n A Web Application Hacker’s Methodology
from any other site can perform two-way interaction, riding on the sessions
of application users. This would allow all data to be retrieved, and
any user actions to be performed, by any other domain.
12.4.2 Check for the /clientaccesspolicy.xml file. Similar to Flash, if the
configuration is too permissive, other sites
can perform two-way interaction with the site under assessment.
12.4.3 Test an application’s handling of cross-domain requests using
XMLHttpRequest by adding an Origin header specifying a different
domain and examining any Access-Control headers that are returned.
The security implications of allowing two-way access from any domain,
or from specified other domains, are the same as those described for the
Flash cross-domain policy.
13 Follow Up Any Information Leakage
13.1 In all your probing of the target application, monitor its responses for
error messages that may contain useful information about the error’s
cause, the technologies in use, and the application’s internal structure
and functionality.
13.2 If you receive any unusual error messages, investigate these using standard
search engines. You can use various advanced search features to
narrow down your results. For example:
“unable to retrieve” filetype:php
13.3 Review the search results, looking both for any discussion about the
error message and for any other websites in which the same message has
appeared. Other applications may produce the same message in a more
verbose context, enabling you to better understand what kind of conditions
give rise to the error. Use the search engine cache to retrieve examples
of error messages that no longer appear within the live application.
13.4 Use Google code search to locate any publicly available code that may
be responsible for a particular error message. Search for snippets of error
messages that may be hard-coded into the application’s source code.
You can also use various advanced search features to specify the code
language and other details, if these are known. For example:
unable\ to\ retrieve lang:php package:mail
13.5 If you receive error messages with stack traces containing the names
of library and third-party code components, search for these names on
both types of search engine.