the-web-application-hackers-handbook

Chapter 4 n Mapping the Application 91
6. Perform the same queries on other domain names belonging to the same
organization, which may contain useful information about the application
you are targeting.
If your research identifies old content and functionality that is no longer
linked to within the main application, it may still be present and usable. The
old functionality may contain vulnerabilities that do not exist elsewhere
within the application.
Even where old content has been removed from the live application, the
content obtained from a search engine cache or web archive may contain
references to or clues about other functionality that is still present within the
live application and that can be used to attack it.
Another public source of useful information about the target application is
any posts that developers and others have made to Internet forums. There are
numerous such forums in which software designers and programmers ask
and answer technical questions. Often, items posted to these forums contain
information about an application that is of direct benefit to an attacker, including
the technologies in use, the functionality implemented, problems encountered
during development, known security bugs, configuration and log files submitted
to assist in troubleshooting, and even extracts of source code.
HACK STEPS
1. Compile a list containing every name and e-mail address you can discover
relating to the target application and its development. This should include
any known developers, names found within HTML source code, names found
in the contact information section of the main company website, and any
names disclosed within the application itself, such as administrative staff.
2. Using the search techniques described previously, search for each identified
name to find any questions and answers they have posted to Internet
forums. Review any information found for clues about functionality or vulnerabilities
within the target application.
Leveraging the Web Server
Vulnerabilities may exist at the web server layer that enable you to discover
content and functionality that are not linked within the web application itself.
For example, bugs within web server software can allow an attacker to list the
contents of directories or obtain the raw source for dynamic server-executable
pages. See Chapter 18 for some examples of these vulnerabilities and ways in
which you can identify them. If such a bug exists, you may be able to exploit it to
directly obtain a listing of all pages and other resources within the application.