Identifying relevant files and directories from crawling results

We have already crawled an application's full directory and have the complete list of referenced files and directories inside it. The next natural step is to identify which of those files contain relevant information or represent an opportunity to have a greater chance of finding vulnerabilities.

More than a recipe, this will be a catalog of common names, suffixes, or prefixes that are used for files and directories that usually lead to information useful for the penetration tester or to the exploitation of vulnerabilities that may end in a complete system compromise.

How to do it...

1. First, what we want to look for is login and registration pages, the ones that can give us the chance to become legitimate users of the application, or to impersonate one by guessing usernames and passwords. Some examples of names or partial names are:

   • Account

   • Auth

   • Login

   • Logon

   • Registration

   • Register

   • Signup

   • Signin

2. Another common source of usernames, passwords...