The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Application logs are often a gold mine of information, and may contain

numerous items of data that can be used as identifiers to probe functionality

that is accessed in this way. Identifiers commonly found within application logs

include: usernames, user ID numbers, account numbers, document IDs, user

groups and roles, and email addresses.

N OT E

In addition to being used as references to data-based resources 

within the application, this kind of identifier is also often used to refer to

functions of the application itself. As you saw in Chapter 4, an application may

deliver different functions via a single page, which accepts a function name or

identifier as a parameter. Again in this situation, access controls may run no

deeper than the presence or absence of specific URLs within the interfaces