the-web-application-hackers-handbook

92 Chapter 4 n Mapping the Application
Many application servers ship with default content that may help you attack
them. For example, sample and diagnostic scripts may contain known vulnerabilities
or functionality that may be leveraged for a malicious purpose.
Furthermore, many web applications incorporate common third-party components
for standard functionality, such as shopping carts, discussion forums,
or content management system (CMS) functions. These are often installed to a
fixed location relative to the web root or to the application’s starting directory.
Automated tools lend themselves naturally to this type of task, and many
issue requests from a large database of known default web server content, thirdparty
application components, and common directory names. While these tools
do not rigorously test for any hidden custom functionality, they can often be
useful in discovering other resources that are not linked within the application
and that may be of interest in formulating an attack.
Wikto is one of the many free tools that performs these types of scans, additionally
containing a configurable brute-force list for content. As shown in
Figure 4-9, when used against the Extreme Internet Shopping site, it identifies
some directories using its internal wordlist. Because it has a large database of
common web application software and scripts, it has also identified the following
directory, which an attacker would not discover through automated or
user-driven spidering:
http://eis/phpmyadmin/
Figure 4-9: Wikto being used to discover content and some known vulnerabilities
Additionally, although the /gb directory had already been identified via
spidering, Wikto has identified the specific URL:
/gb/index.php?login=true
Wikto checks for this URL because it is used in the gbook PHP application,
which contains a publicly known vulnerability.