Developer's Guide to Web Application Security

AttachFile, and AttachURL. An attacker might be able to trick your appli-

cation into attaching a file you don’t want to be sent out.This is similar to

the file system-based vulnerabilities described earlier.

■

Java The inclusion of the java.net.* package(s), and especially for the use

of ServerSocket (which means your application is listening for inbound

requests).Also, keep a watch for the inclusion of java.rmi.*. RMI is Java’s

remote method invocation, which is functionally similar to CORBA’s.

■

ColdFusion Look for the tags CFFTP, CFHTTP, CFLDAP, CFMail, and

CFPOP.

Pulling It All Together

So, now that you have this large list of target functions/commands, ...