the-web-application-hackers-handbook

94 Chapter 4 n Mapping the Application
they navigated the set of files created by the author, requesting each file via its
name within the directory tree residing on the server.
Although the evolution of web applications has fundamentally changed the
experience of interacting with the web, the picture just described is still applicable
to the majority of web application content and functionality. Individual
functions are typically accessed via a unique URL, which is usually the name
of the server-side script that implements the function. The parameters to the
request (residing in either the URL query string or the body of a POST request)
do not tell the application what function to perform; they tell it what information
to use when performing it. In this context, the methodology of constructing a
URL-based map can be effective in cataloging the application’s functionality.
In applications that use REST-style URLs, parts of the URL file path contain
strings that in fact function as parameter values. In this situation, by mapping
URLs, a spider maps both the application functions and the list of known
parameter values to those functions.
In some applications, however, the picture based on application “pages”
is inappropriate. Although it may be possible to shoehorn any application’s
structure into this form of representation, in many cases a different picture,
based on functional paths, is far more useful for cataloging its content and
functionality. Consider an application that is accessed using only requests of
the following form:
POST /bank.jsp HTTP/1.1
Host: wahh-bank.com
Content-Length: 106
servlet=TransferFunds&method=confirmTransfer&fromAccount=10372918&to
Account=
3910852&amount=291.23&Submit=Ok
Here, every request is made to a single URL. The parameters to the request
are used to tell the application what function to perform by naming the Java
servlet and method to invoke. Further parameters provide the information to
use in performing the function. In the picture based on application pages, the
application appears to have only a single function, and a URL-based map does
not elucidate its functionality. However, if we map the application in terms of
functional paths, we can obtain a much more informative and useful catalog of
its functionality. Figure 4-10 is a partial map of the functional paths that exist
within the application.