the-web-application-hackers-handbook

44 Chapter 3 n Web Application Technologies
Many other HTTP methods exist that are not directly relevant to attacking
web applications. However, a web server may expose itself to attack if certain
dangerous methods are available. See Chapter 18 for further details on these
methods and examples of using them in an attack.
URLs
A uniform resource locator (URL) is a unique identifier for a web resource through
which that resource can be retrieved. The format of most URLs is as follows:
protocol://hostname[:port]/[path/]file[?param=value]
Several components in this scheme are optional. The port number usually is
included only if it differs from the default used by the relevant protocol. The
URL used to generate the HTTP request shown earlier is as follows:
https://mdsec.net/auth/488/YourDetails.ashx?uid=129
In addition to this absolute form, URLs may be specified relative to a particular
host, or relative to a particular path on that host. For example:
/auth/488/YourDetails.ashx?uid=129
YourDetails.ashx?uid=129
These relative forms are often used in web pages to describe navigation within
the website or application itself.
NOTE You may encounter the term URI (or uniform resource identifier)
being used instead of URL, but it is really only used in formal specifications
and by those who want to exhibit their pedantry.
REST
Representational state transfer (REST) is a style of architecture for distributed
systems in which requests and responses contain representations of the current
state of the system’s resources. The core technologies employed in the World
Wide Web, including the HTTP protocol and the format of URLs, conform to
the REST architectural style.
Although URLs containing parameters within the query string do themselves
conform to REST constraints, the term “REST-style URL” is often used to signify
a URL that contains its parameters within the URL file path, rather than the
query string. For example, the following URL containing a query string:
http://wahh-app.com/search?make=ford&model=pinto
corresponds to the following URL containing “REST-style” parameters:
http://wahh-app.com/search/ford/pinto