Penetration Testing tips

Check the source code to determine whether to use the open-source architecture. If so, check what framework and version it is? Because programmers use basic configurations when using open-source frameworks, or retain files not used in the frameworks, and vulnerabilities inherent in open-source frameworks, there are serious security problems, it is also a breakthrough of Penetration Tester. When viewing the source code, we can pay attention to the following points (example): 1) Comment Statement 1 <! -- <Div id = "footer _"> 2 <div id = "f-poweredbyico"> <a href = "http://www.xxx.com"> </a> </div> 3 www.2cto.com 4 </div> --> 2) the common url/wiki/skins/common/images/wiki/skins/common/commonPrint.css shows that mediawiki is used. We can further analyze the directory structure of mediawiki, pay attention to some important file directories, such as \ mediawiki \ receivdes \ DefaultSettings. php \ mediawiki \ schemdes \ SiteConfiguration. php accessible (many open source framework developers do not pay attention to access control settings for important folders and files)