One more thing to look for is the Cookies...
Often ignored by ppl thisis a vital source for leaking information. any web based application should have their cookies encrypted and it should not be readable at all for normal people.

Thanks,
Kunal