Identifying relevant files and directories from crawling results

We already crawled a full application's directory and have the list of all referenced files and directories inside it. The natural next step is to identify which of those contains relevant information or represents an opportunity to have a greater chance of finding vulnerabilities.

More than a recipe, this will be a catalog of common names, suffixes, or prefixes used for files and directories that usually lead to information useful to the penetration tester or to the exploitation of vulnerabilities that may end in complete system compromise.

How to do it...

Here are the steps:

1. The first thing we want to look for are the login and registration pages, the ones that could give us the chance to become legitimate users of the application or to impersonate one by guessing usernames and passwords. Some examples of names or partial names are:
   • Account
   • Auth
   • Login
   • Logon
   • Registration
   • Register
   • Signup
   • Signin
2. Other common sources of usernames, passwords...