the-web-application-hackers-handbook

114 Chapter 4 n Mapping the Application
Summary
Mapping the application is a key prerequisite to attacking it. It may be tempting
to dive in and start probing for bugs, but taking time to gain a sound understanding
of the application’s functionality, technologies, and attack surface will
pay dividends down the line.
As with almost all of web application hacking, the most effective approach
is to use manual techniques supplemented where appropriate by controlled
automation. No fully automated tool can carry out a thorough mapping of the
application in a safe way. To do this, you need to use your hands and draw on
your own experience. The core methodology we have outlined involves the
following:
n Manual browsing and user-directed spidering to enumerate the application’s
visible content and functionality
n Use of brute force combined with human inference and intuition to discover
as much hidden content as possible
n An intelligent analysis of the application to identify its key functionality,
behavior, security mechanisms, and technologies
n An assessment of the application’s attack surface, highlighting the most
promising functions and behavior for more focused probing into exploitable
vulnerabilities
Questions
Answers can be found at http://mdsec.net/wahh.
1. While mapping an application, you encounter the following URL:
https://wahh-app.com/CookieAuth.dll?GetLogon?curl=Z2Fdefault.
aspx
What information can you deduce about the technologies employed on
the server and how it is likely to behave?
2. The application you are targeting implements web forum functionality.
Here is the only URL you have discovered:
http://wahh-app.com/forums/ucp.php?mode=register
How might you obtain a listing of forum members?