Identifying Server-Side Functionality
It is often possible to infer a great deal about server-side functionality and structure, or at least make an educated
Read moreMapping the Application
Identifying Server-Side Technologies
It is normally possible to fingerprint the technologies employed on the server via various clues and indicators. Banner Grabbing Many
Read moreAnalyzing the Application
Enumerating as much of the application’s content as possible is only one element of the mapping process. Equally important is
Read moreApplication Pages vs. Functional Paths
The enumeration techniques described so far have been implicitly driven by one particular picture of how web application content may
Read moreDiscovering Hidden Content
It is very common for applications to contain content and functionality which is not directly linked or reachable from the
Read moreUser-Directed Spidering
This is a more sophisticated and controlled technique, which is usually preferable to automated spidering. Here, the user walks through
Read moreEnumerating Content and Functionality
In a typical application, the majority of the content and functionality can be identified via manual browsing. The basic approach
Read moreMapping the Application
The first step in the process of attacking an application is to gather and examine some key information about it,
Read more