The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 4 

■

Mapping the Application

79

70779c04.qxd:WileyRed  9/14/07  3:12 PM  Page 79

---

Some key areas to investigate are:

■■

The core functionality of the application — the actions that it can be

leveraged to perform when used as intended.

■■

Other more peripheral behavior of the application, including off-site

links, error messages, administrative and logging functions, use of redi-

rects, and so on.

■■

The core security mechanisms and how they function, in particular

management of session state, access controls, and authentication mech-

anisms and supporting logic (user registration, password change,

account recovery, etc.).

■■

All of the different locations at which user-supplied input is processed

by the application — every URL, query string parameter, item of 

POST

data, cookie, and the like.

■■

The technologies employed on the client side, including forms, client-

side scripts, thick-client components (Java applets, ActiveX controls,

and Flash), and cookies.

■■

The technologies employed on the server side, including static and

dynamic pages, the types of request parameters employed, use of SSL,

web server software, interaction with databases, email systems and

other back-end components.

■■

Any other details that may be gleaned about the internal structure and

functionality of the server-side application — the mechanisms it uses

behind the scenes to deliver the functionality and behavior that is visi-

ble from the client perspective.