the-web-application-hackers-handbook

Chapter 21 n A Web Application Hacker’s Methodology 799
authentication, session management, and access control, and the functions
that support them, such as user registration and account recovery.
2.1.3 Identify all the more peripheral functions and behavior, such as the use
of redirects, off-site links, error messages, and administrative and logging
functions.
2.1.4 Identify any functionality that diverges from the standard GUI appearance,
parameter naming, or navigation mechanism used elsewhere in
the application, and single it out for in-depth testing.
2.2 Identify Data Entry Points
2.2.1 Identify all the different entry points that exist for introducing user
input into the application’s processing, including URLs, query string
parameters, POST data, cookies, and other HTTP headers processed by
the application.
2.2.2 Examine any customized data transmission or encoding mechanisms
used by the application, such as a nonstandard query string format.
Understand whether the data being submitted encapsulates parameter
names and values, or whether an alternative means of representation
is being used.
2.2.3 Identify any out-of-band channels via which user-controllable or other
third-party data is being introduced into the application’s processing.
An example is a web mail application that processes and renders messages
received via SMTP.
2.3 Identify the Technologies Used
2.3.1 Identify each of the different technologies used on the client side, such as
forms, scripts, cookies, Java applets, ActiveX controls, and Flash objects.
2.3.2 As far as possible, establish which technologies are being used on the
server side, including scripting languages, application platforms, and
interaction with back-end components such as databases and e-mail
systems.
2.3.3 Check the HTTP Server header returned in application responses, and
also check for any other software identifiers contained within custom
HTTP headers or HTML source code comments. Note that in some cases,
different areas of the application are handled by different back-end
components, so different banners may be received.
2.3.4 Run the Httprint tool to fingerprint the web server.
2.3.5 Review the results of your content-mapping exercises to identify any
interesting-looking file extensions, directories, or other URL subsequences