the-web-application-hackers-handbook

Chapter 4 n Mapping the Application 81
to review the page source for vulnerabilities that can then be exploited
on the live page.
n Backup archives that contain a full snapshot of files within (or indeed
outside) the web root, possibly enabling you to easily identify all content
and functionality within the application.
n New functionality that has been deployed to the server for testing but not
yet linked from the main application.
n Default application functionality in an off-the-shelf application that has
been superficially hidden from the user but is still present on the server.
n Old versions of files that have not been removed from the server. In the
case of dynamic pages, these may contain vulnerabilities that have been
fixed in the current version but that can still be exploited in the old version.
n Configuration and include files containing sensitive data such as database
credentials.
n Source files from which the live application’s functionality has been
compiled.
n Comments in source code that in extreme cases may contain information
such as usernames and passwords but that more likely provide information
about the state of the application. Key phrases such as “test this function”
or something similar are strong indicators of where to start hunting for
vulnerabilities.
n Log files that may contain sensitive information such as valid usernames,
session tokens, URLs visited, and actions performed.
Effective discovery of hidden content requires a combination of automated and
manual techniques and often relies on a degree of luck.
Brute-Force Techniques
Chapter 14 describes how automated techniques can be leveraged to speed up
just about any attack against an application. In the present context of information
gathering, automation can be used to make huge numbers of requests to the
web server, attempting to guess the names or identifiers of hidden functionality.
For example, suppose that your user-directed spidering has identified the
following application content:
http://eis/auth/Login
http://eis/auth/ForgotPassword
http://eis/home/
http://eis/pub/media/100/view
http://eis/images/eis.gif
http://eis/include/eis.css