The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Mapping the Application

70779c04.qxd:WileyRed  9/14/07  3:12 PM  Page 68

---

may be part of the application’s intended logic, and this should be

investigated further.

■■

400 Bad Request – The application may use a custom naming scheme

for directories and files within URLs, which a particular request has not

complied with. More likely, however, is that the wordlist you are using

contains some whitespace characters or other invalid syntax.

■■

401 Unauthorized or 403 Forbidden – This usually indicates that the

requested resource exists but may not be accessed by any user,

regardless of authentication status or privilege level. It often occurs when

directories are requested, and you may infer that the directory exists.

■■