the-web-application-hackers-handbook

798 Chapter 21 n A Web Application Hacker’s Methodology
1.5.3 If applicable, compile a map of application content based on functional paths,
rather than URLs, showing all the enumerated functions and the logical
paths and dependencies between them. (See Chapter 4 for an example.)
1.6 Test for Debug Parameters
1.6.1 Choose one or more application pages or functions where hidden debug
parameters (such as debug=true) may be implemented. These are most
likely to appear in key functionality such as login, search, and file upload
or download.
1.6.2 Use listings of common debug parameter names (such as debug, test,
hide, and source) and common values (such as true, yes, on, and 1).
Iterate through all permutations of these, submitting each name/value
pair to each targeted function. For POST requests, supply the parameter
in both the URL query string and the request body. Use the techniques
described in Chapter 14 to automate this exercise. For example, you
can use the cluster bomb attack type in Burp Intruder to combine all
permutations of two payload lists.
1.6.3 Review the application’s responses for any anomalies that may indicate
that the added parameter has had an effect on the application’s processing.
2 Analyze the Application
2.1. Identify
functionality
2.2. Identify data
entry points
2.3. Identify
technologies
2.4. Map the attack surface
Figure 21-3: Analyzing the application
2.1 Identify Functionality
2.1.1 Identify the core functionality that the application was created for and
the actions that each function is designed to perform when used as
intended.
2.1.2 Identify the core security mechanisms employed by the application and
how they work. In particular, understand the key mechanisms that handle