The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 4 

■

Mapping the Application

93

70779c04.qxd:WileyRed  9/14/07  3:12 PM  Page 93

---

by each request are shown here. From these headers alone, what can

you deduce about the presence of the requested resource within each

application?

HTTP/1.1 200 OK

Server: Microsoft-IIS/5.0

Expires: Mon, 25 Jun 2007 14:59:21 GMT

Content-Location: http://wahh-app.com/includes/error.htm?404;http://

wahh-app.com/admin.cpf

Date: Mon, 25 Jun 2007 14:59:21 GMT

Content-Type: text/html

Accept-Ranges: bytes

Content-Length: 2117

HTTP/1.1 401 Unauthorized

Server: Apache-Coyote/1.1

WWW-Authenticate: Basic realm=”Wahh Administration Site”

Content-Type: text/html;charset=utf-8

Content-Length: 954

Date: Mon, 25 Jun 2007 15:07:27 GMT

Connection: close