The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

request, check whether the original response already contains any of the

keywords you are looking for, to avoid false positives.

■

You can use the Grep function of Burp Intruder to quickly identify any

occurrences of interesting keywords in any of the responses generated

by a given attack (see Chapter 13). Where matches are found, review the

relevant responses manually to determine whether any useful error

information has been returned.

510

Chapter 14 

■

Exploiting Information Disclosure

70779c14.qxd:WileyRed  9/14/07  3:14 PM  Page 510

---

T I P

If you are viewing the server’s responses in-browser, be aware that Internet

Explorer by default hides many error messages and replaces them with a generic