The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Brute-Force Techniques

In Chapter 13, we will describe how automated techniques can be leveraged to

speed up just about any attack against an application. In the present context,

automation can be used to make huge numbers of requests to the web server,

attempting to guess the names or identifiers of hidden functionality.

Chapter 4 

■

Mapping the Application

67

70779c04.qxd:WileyRed  9/14/07  3:12 PM  Page 67

---

For example, suppose that your user-directed spidering has identified the

following application content:

https://wahh-app.com/login.php

https://wahh-app.com/home/myaccount.php

https://wahh-app.com/home/logout.php

https://wahh-app.com/help/

https://wahh-app.com/register.php

https://wahh-app.com/menu.js

https://wahh-app.com/scripts/validate.js

The first step in an automated effort to identify hidden content might

involve the following requests, to locate additional directories:

https://wahh-app.com/access/

https://wahh-app.com/account/

https://wahh-app.com/accounts/

https://wahh-app.com/accounting/

https://wahh-app.com/admin/

https://wahh-app.com/agent/

https://wahh-app.com/agents/

...

Next, the following requests could be made, to locate additional pages:

https://wahh-app.com/access.php

https://wahh-app.com/account.php

https://wahh-app.com/accounts.php

https://wahh-app.com/accounting.php

https://wahh-app.com/admin.php

https://wahh-app.com/agent.php

https://wahh-app.com/agents.php

...

https://wahh-app.com/home/access.php

https://wahh-app.com/home/account.php

https://wahh-app.com/home/accounts.php

https://wahh-app.com/home/accounting.php

https://wahh-app.com/home/admin.php

https://wahh-app.com/home/agent.php

https://wahh-app.com/home/agents.php

...