Now a days every app has a module for notifying users through email. The same email module/service when written less carefully can lead to serious misuse by the attacker. Attacker can spam the inbox of any user when the app is vulnerable to this issue. Below is the example of vulnerable webapps test with explanation.
Suppose the reset password functionality is vulnerable to email bombing.
url – https://example.com/lost-password
Open it and you see a form to notify you by email. try putting email and send. Monitor and capture the request.
For now i take below headers:
POST /lost-password HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.04
Accept-Encoding: gzip, deflate, br
Cookie: lang=en; xyz
Looking at the header and body , we can see that their is no way for the web server to track user or to validate the genuine request. So we can replay the same request with different POST data using any client.
Token system can be used to avoid spamming. Using token , the server side code will be able to authorize the request before processing.
1. Create the token[long alphanumeric number] on page load on server side and send it to client where it will be a hidden input.
2. Create a session-variable and store the token value in it.
3. Client when requesting again will send the hidden input token with HTTP request.
4. On server side the session-variable token and the token from client side will be match.
5. If matched then process the request and create a new token again and also store it to session-variable.
6. if not matched the throw error message.
Try the application. Below is the Demo link and the source code.
Demo Download source
Spamming is the common issue found in the web apps. Mostly the modules of the application like notification sent on “email/phone” or operations performed like “database insertion/file creation on server” are the places where spamming can me done when vulnerable.
If the application is not able to identify the forged request and the same request is entertained by the application several times then the attacker can use it to spam a registered user or any user depending upon the applications behavior.
Below is the demo link and source to the spamming vulnerable app.
Demo Download source