the-web-application-hackers-handbook

Chapter 4 n Mapping the Application 85
regardless of authentication status or privilege level. It often occurs when
directories are requested, and you may infer that the directory exists.
n 500 Internal Server Error — During content discovery, this usually
indicates that the application expects certain parameters to be submitted
when requesting the resource.
The various possible responses that may indicate the presence of interesting
content mean that is difficult to write a fully automated script to output a listing
of valid resources. The best approach is to capture as much information as
possible about the application’s responses during the brute-force exercise and
manually review it.
HACK STEPS
1. Make some manual requests for known valid and invalid resources, and
identify how the server handles the latter.
2. Use the site map generated through user-directed spidering as a basis for
automated discovery of hidden content.
3. Make automated requests for common filenames and directories within
each directory or path known to exist within the application. Use Burp
Intruder or a custom script, together with wordlists of common files and
directories, to quickly generate large numbers of requests. If you have identified
a particular way in which the application handles requests for invalid
resources (such as a customized “file not found” page), configure Intruder
or your script to highlight these results so that they can be ignored.
4. Capture the responses received from the server, and manually review
them to identify valid resources.
5. Perform the exercise recursively as new content is discovered.
Inference from Published Content
Most applications employ some kind of naming scheme for their content and
functionality. By inferring from the resources already identified within the
application, it is possible to fine-tune your automated enumeration exercise to
increase the likelihood of discovering further hidden content.
In the EIS application, note that all resources in /auth start with a capital letter.
This is why the wordlist used in the file brute forcing in the previous section
was deliberately capitalized. Furthermore, since we have already identified a
page called ForgotPassword in the /auth directory, we can search for similarly
named items, such as the following:
http://eis/auth/ResetPassword