The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

T I P

In addition to the proxy/spider tools just described, another range of

tools that are often useful during application mapping are the various browser

extensions that can perform HTTP and HTML analysis from within the browser

interface. For example, the IEWatch tool illustrated in Figure 4-2, which runs

within Microsoft Internet Explorer, monitors all details of requests and

responses, including headers, request parameters, and cookies, and analyzes

every application page to display links, scripts, forms, and thick-client

components. While all of this information can, of course, be viewed in 

your intercepting proxy, having a second record of useful mapping data can

only help you better understand the application and enumerate all of its

functionality. See Chapter 19 for more information about tools of this kind.