Application Pages vs. Functional Paths
The enumeration techniques described so far have been implicitly driven by one particular picture of how web application content may
Read moreWeb Hosting
Discovering Hidden Content
It is very common for applications to contain content and functionality which is not directly linked or reachable from the
Read moreUser-Directed Spidering
This is a more sophisticated and controlled technique, which is usually preferable to automated spidering. Here, the user walks through
Read moreEnumerating Content and Functionality
In a typical application, the majority of the content and functionality can be identified via manual browsing. The basic approach
Read moreMapping the Application
The first step in the process of attacking an application is to gather and examine some key information about it,
Read moreEncoding Schemes
Web applications employ several different encoding schemes for their data. Both the HTTP protocol and the HTML language are historically
Read moreState and Sessions
The technologies described so far enable the server and client components of a web application to exchange and process data
Read moreClient-Side Functionality
In order for the server-side application to receive user input and actions, and present the results of these back to
Read moreWeb Functionality
In addition to the core communications protocol used to send messages between client and server, web applications employ numerous different
Read more