the-web-application-hackers-handbook

84 Chapter 4 n Mapping the Application
Figure 4-6: Burp Intruder showing the results of a file brute-force attack
NOTE Do not assume that the application will respond with 200 OK if a
requested resource exists and 404 Not Found if it does not. Many applications
handle requests for nonexistent resources in a customized way, often
returning a bespoke error message and a 200 response code. Furthermore,
some requests for existent resources may receive a non-200 response. The following
is a rough guide to the likely meaning of the response codes that you
may encounter during a brute-force exercise looking for hidden content:
n 302 Found — If the redirect is to a login page, the resource may be
accessible only by authenticated users. If the redirect is to an error message,
this may indicate a different reason. If it is to another location, the
redirect may be part of the application’s intended logic, and this should
be investigated further.
n 400 Bad Request — The application may use a custom naming scheme
for directories and files within URLs, which a particular request has not
complied with. More likely, however, is that the wordlist you are using
contains some whitespace characters or other invalid syntax.
n 401 Unauthorized or 403 Forbidden — This usually indicates that
the requested resource exists but may not be accessed by any user,