Web Application Defender's Cookbook

Input Validation Anomalies

The remaining recipes in this chapter focus on identifying request data formatting and construction anomalies. For our sample target application, we will use the OWASP Damn Vulnerable Web Application’s Brute Force lesson, as shown in Figure 5-1.

Figure 5-1: OWASP DVWA’s Brute Force lesson login page

As you can see, the login page has two user input fields: Username and Password. When the client clicks the Login button, a GET request is sent that looks similar to the following:

GET /dvwa/vulnerabilities/brute/?username=bob&password=
lfhafla94732972&Login=Login HTTP/1.1
Host: 192.168.168.128
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0)
 Gecko/20100101 Firefox/11.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;
q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://192.168.168.128/dvwa/vulnerabilities/brute/
Cookie: security=high; security=high; 
PHPSESSID=33tmp10d1b7l2rfrhtncm3f605

The following recipes generate alerts based on anomalies identified by the learned application profile outlined in Recipe 1-1 in Chapter 1.