Understanding Forced Browsing and Session-Cookie Flaws

Ways to Know Existence of a Link After Login

There are multiple cases in which a security expert can know about the existence of a link that is available after login:

1. As part of a White/Grey box exercise, he gets both all the user roles to test.

2. He guesses or brute forces (makes a script that tries all common page names).

3. He reads the source code and finds interesting links in the comments or in the code or even in other files like JS, CSS, etc. linked inside the source code.

4. He finds a user manual or other screenshots of the application (from search engines or on the website itself) and reads it to find a screenshot or a step telling the admin to visit a specific post login page.

5. He uses google dorks like site:x.com inurl:seller/actions and find a page indexed in google.

6. He finds sitemap files like sitemap.xml and robots.txt using google dork site:x.com sitemap robots.txt which contains list of links on the website.

7. He uses social engineering on a phone call to the seller support and asks them their present URL.