The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

may reach different content and code paths within the application.

■

Review the site map generated by the proxy/spider tool, and identify any

application content or functions that you did not browse manually.

Establish how the spider enumerated each item — for example, in Burp

Spider, check the Linked From details. Using your browser, access the

item manually, so that the response from the server is parsed by the

proxy/spider tool to identify any further content. Continue this step

recursively until no further content or functionality is identified. 

■

Optionally, tell the tool to actively spider the site using all of the already

enumerated content as a starting point. To do this, first identify any URLs

that are dangerous or likely to break the application session, and config-