The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

functions for hidden parameter discovery. Choose functions where it is

most likely that developers have implemented debug logic, such as login,

search, file uploading and downloading, and the like.

Analyzing the Application

Enumerating as much of the application’s content as possible is only one ele-

ment of the mapping process. Equally important is the task of analyzing the

application’s functionality, behavior, and technologies employed, in order to

identify the key attack surfaces that it exposes, and begin formulating an

approach to probing the application for exploitable vulnerabilities.