The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

(see Chapter 19).

■

Search for temporary files which may have been created inadvertently by

developer tools and file editors — for example, the .

DS_Store

file, which

contains a directory index under OSX, or 

file.php~1

, which is a tempo-

rary file created when 

file.php

is edited.

■

Perform further automated exercises, combining the lists of directories,

file stems, and file extensions to request large numbers of potential

resources. For example, in a given directory, request each file stem com-

bined with each file extension. Or request each directory name as a sub-

directory of every known directory.

■

Where a consistent naming scheme has been identified, consider per-