The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

When you are probing the application for common vulnerabilities by sub-

mitting crafted attack strings in different parameters, always monitor the

application’s responses to identify any error messages that may contain

useful information.

■

Be aware that error information which is returned within the server’s

response may not be rendered on-screen within the browser. An efficient

way to identify many error conditions is to search each raw response for

keywords that are often contained in error messages. For example:

error

exception

illegal

invalid

fail

stack

access

directory

file

not found

varchar

ODBC

SQL 

SELECT

■

When you send a series of requests modifying parameters within a base