4.0

179
Web Application Penetration Testing
ness_logic_flaws.html
• Toward Automated Detection of Logic Vulnerabilities in Web
Applications - Viktoria Felmetsger Ludovico Cavedon Christopher
Kruegel Giovanni Vigna - https://www.usenix.org/legacy/
event/sec10/tech/full_papers/Felmetsger.pdf
• 2012 Web Session Intelligence & Security Report: Business
Logic Abuse, Dr. Ponemon - http://www.emc.com/collateral/
rsa/silvertail/rsa-silver-tail-ponemon-ar.pdf
• 2012 Web Session Intelligence & Security Report: Business
Logic Abuse (UK) Edition, Dr. Ponemon - http://buzz.silvertailsystems.com/Ponemon_UK.htm
OWASP Related
• Business Logic Attacks – Bots and Bats, Eldad Chai - http://
www.imperva.com/resources/adc/pdfs/AppSecEU09_BusinessLogicAttacks_EldadChai.pdf
• OWASP Detail Misuse Cases - https://www.owasp.org/index.
php/Detail_misuse_cases
• How to Prevent Business Flaws Vulnerabilities in Web Applications,
Marco Morana - http://www.slideshare.net/marco_morana/issa-louisville-2010morana
Useful Web Sites
• Abuse of Functionality - http://projects.webappsec.org/w/
page/13246913/Abuse-of-Functionality
• Business logic - http://en.wikipedia.org/wiki/Business_logic
• Business Logic Flaws and Yahoo Games - http://jeremiahgrossman.blogspot.com/2006/12/business-logic-flaws.html
• CWE-840: Business Logic Errors - http://cwe.mitre.org/data/
definitions/840.html
• Defying Logic: Theory, Design, and Implementation of Complex
Systems for Testing Application Logic -
http://www.slideshare.net/RafalLos/defying-logic-business-logic-testing-with-automation
• Prevent application logic attacks with sound app security
practices - http://searchappsecurity.techtarget.
com/qna/0,289202,sid92_gci1213424,00.html?bucket=NEWS&topic=302570
• Real-Life Example of a ‘Business Logic Defect - http://h30501.
www3.hp.com/t5/Following-the-White-Rabbit-A/Real-Life-
Example-of-a-Business-Logic-Defect-Screen-Shots/bap/22581
• Software Testing Lifecycle - http://softwaretestingfundamentals.com/software-testing-life-cycle/
• Top 10 Business Logic Attack Vectors Attacking and Exploiting
Business Application Assets and Flaws – Vulnerability Detection
to Fix -
http://www.ntobjectives.com/go/business-logic-attack-vectors-white-paper/
and http://www.ntobjectives.com/files/
Business_Logic_White_Paper.pdf
Books
• The Decision Model: A Business Logic Framework Linking Business
and Technology, By Barbara Von Halle, Larry Goldberg, Published
by CRC Press, ISBN1420082817 (2010)
Test business logic data validation
(OTG-BUSLOGIC-001)
Summary
The application must ensure that only logically valid data can be
entered at the front end as well as directly to the server side of
an application of system. Only verifying data locally may leave
applications vulnerable to server injections through proxies or at
handoffs with other systems. This is different from simply performing
Boundary Value Analysis (BVA) in that it is more difficult
and in most cases cannot be simply verified at the entry point,
but usually requires checking some other system.
For example: An application may ask for your Social Security
Number. In BVA the application should check formats and semantics
(is the value 9 digits long, not negative and not all 0’s) for
the data entered, but there are logic considerations also. SSNs
are grouped and categorized. Is this person on a death file? Are
they from a certain part of the country?
Vulnerabilities related to business data validation is unique in
that they are application specific and different from the vulnerabilities
related to forging requests in that they are more concerned
about logical data as opposed to simply breaking the
business logic workflow.
The front end and the back end of the application should be verifying
and validating that the data it has, is using and is passing
along is logically valid. Even if the user provides valid data to an
application the business logic may make the application behave
differently depending on data or circumstances.
Examples
Example 1
Suppose you manage a multi-tiered e-commerce site that allows
users to order carpet. The user selects their carpet, enters the
size, makes the payment, and the front end application has verified
that all entered information is correct and valid for contact
information, size, make and color of the carpet. But, the business
logic in the background has two paths, if the carpet is in stock it
is directly shipped from your warehouse, but if it is out of stock in
your warehouse a call is made to a partner’s system and if they
have it in-stock they will ship the order from their warehouse
and reimbursed by them. What happens if an attacker is able to
continue a valid in-stock transaction and send it as out-of-stock
to your partner? What happens if an attacker is able to get in the
middle and send messages to the partner warehouse ordering
carpet without payment?
Example 2
Many credit card systems are now downloading account balances
nightly so the customers can check out more quickly for
amounts under a certain value. The inverse is also true. I
f I pay my credit card off in the morning I may not be able to use
the available credit in the evening. Another example may be if I
use my credit card at multiple locations very quickly it may be