On Dec 9th, Dafydd Stuttard (otherwise known as Portswigger) released Burp Suite v1.1. Burp Suite is an integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking an application. All tools share the same robust framework for handling HTTP requests, authentication, downstream proxies, logging, alerting and extensibility.
Recently, I started to really dig into my copy of The Web Application Hacker's Handbook and overall I was impressed by the content. In my view, it is more detailed than Hacking Exposed Web Applications.
While looking over the table of contents, one chapter of the The Web Application Hacker's Handbook really caught my eye - Attacking Application Logic.
This type of flaw is much different than your normal software vulnerability. Logic flaws are created by improper business design (or misunderstood logic) and not by the standard programming mistakes. Most logic flaws could be viewed as software hacks more than software vulnerabilities. Because of this, they are rarely (if ever) discovered by automatic scanning tools - hence the need for manual testing.
Attacking application logic is software exploitation without exploits. HD Moore would call it "Tactical Exploitation". It is like you are hacking the mind of the programmer and not his/her code.
In my opinion, it is these type of attacks that form the real foundation of hacking.
No comments:
Post a Comment