The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Figure 4-9:  File extension mappings in IIS 5.0

Chapter 4 

■

Mapping the Application

85

70779c04.qxd:WileyRed  9/14/07  3:12 PM  Page 85

---

It is possible to detect the presence of each file extension mapping via the

different error messages generated when that file extension is requested. 

In some cases, discovering a particular mapping may indicate the presence 

of a web server vulnerability — for example, the 

.printer

and 

.ida

/

.idq

handlers in IIS have in the past been found vulnerable to buffer overflow 

vulnerabilities.

Another common fingerprint to be aware of are URLs that look like the 

following:

https://wahh-app/news/0,,2-421206,00.html

The comma-separated numbers towards the end of the URL are usually gen-

erated by the Vignette content management platform.

Directory Names

It is common to encounter subdirectory names that indicate the presence of an

associated technology. For example:

■■

servlet

— Java servlets

■■

pls

— Oracle Application Server PL/SQL gateway

■■

cfdocs

or 

cfide

— Cold Fusion

■■

SilverStream

— The SilverStream web server

■■

WebObjects

or 

{function}.woa

— Apple WebObjects

■■

rails

— Ruby on Rails

Session Tokens

Many web servers and web application platforms generate session tokens by

default with names that provide information about the technology in use. For

example:

■■

JSESSIONID

— The Java Platform

■■

ASPSESSIONID

— Microsoft IIS server

■■

ASP.NET_SessionId

— Microsoft ASP.NET

■■

CFID

/

CFTOKEN

— Cold Fusion

■■

PHPSESSID

— PHP