The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Review the information gathered during application mapping to identify:

■

Any instance where a request parameter appears to contain the 

name of a file or directory — for example, 

include=main.inc 

or

template=/en/sidebar

.

■

Any application functions whose implementation is likely to involve

retrieval of data from a server file system (as opposed to a back-end

database) — for example, the displaying of office documents or

images.

■

During all testing which you perform in relation to every other kind of

vulnerability, look for error messages or other anomalous events that are

of interest. Try to find any evidence of instances where user-supplied

data is being passed to file APIs or as parameters to operating system