The malicious user is sometimes able to identify the development environment just by viewing the HTML code generated by a web application. Comments and some HTML tags can provide information about the development environment. Upon identifying the development environment, a malicious user is able to exploit vulnerabilities where the example or template may have been used. Another common area for exploitation is the way the application maintains session state information. Cookies are commonly used to maintain state information between subsequent HTTP requests.
Cookies are simply sets of strings written to the browser by the web application server.
They are used to maintain session state, remember passwords and user names, for personalization and configuration features. A malicious user could hijack applications that do not implement strong session controls. Application vulnerabilities are important because they give access to confidential information such as credit-card numbers, account numbers or names and customer lists, without having to break into the web server. The difference between a malicious user and a regular user is intent . These numbers were stolen from the CD Universe web site.