The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Note any error messages returned by the application. If these appear to

relate to any problem in the email function, investigate whether you

need to fine-tune your input to exploit a vulnerability.

■

The application’s responses may not indicate in any way whether a vul-

nerability exists or was successfully exploited. You should monitor the

email address you specified to see if any mails are received.

■

Review closely the HTML form that generates the relevant request. This

may contain clues regarding the server-side software being used. It may

also contain a hidden or disabled field that is used specify the To address

of the email, which you can modify directly.

T I P

Functions to send emails to application support personnel are frequently