Hands-On Bug Hunting for Penetration Testers
上QQ阅读APP看书,第一时间看更新

Sitemaps

Sitemaps are an absurdly simple way of doing basic research with zero effort. Doing a little URL hacking with the  sitemap.xml slug will often return either an actual XML file detailing the site's structure, or a Yoast-or-other-seo-plugin-supplied HTML page documenting different areas of the site, with separate sitemaps for posts, pages, and so on.

The following is an example of a Yoast-generated sitemap page:

It helpfully exposes the high-level structure of the site while allowing you to focus on important points. Some areas can be skipped: the post-sitemap1.xml and post-sitemap2.xml sections, listing the links to every blog post on the site, aren't useful because every blog post will more or less have the same points of attack (comments, like/dislike buttons, and social sharing).

While wp_quiz-sitemap.xml hints at a tantalizing set of form fields, along with telling us the site is a WordPress application if we didn't already know, the page-sitemap.xml will give us a broader swath of site functionality:

Here, too, there are candidates for immediate follow-up and dismissal. Purely informational pages such as /privacy-policy, /method/rule-two, and /pricing-guarantee, are simple markup, with no opportunity to interact with the server or an external service. Pages such as /contact-us, /book-preorder-entry-form (the form's in the title!), and /referral (which might have a form for submitting them) are all worth a follow-up. /jobs, which could have a resume-submission field or could be just job listings, is a gray area. Some pages will simply need to be perused.

Sitemaps aren't always available – and they're always limited to what the site wants to show you  but they can be useful starting points for further investigation.