the-web-application-hackers-handbook

132 Chapter 5 n Bypassing Client-Side Controls
Quantity: (Maximum quantity is 50)
This includes the price of the product as a disabled text field and appears
on-screen as shown in Figure 5-4.
Figure 5-4: A form containing a disabled input field
When this form is submitted, only the quantity parameter is sent to the
server. However, the presence of a disabled field suggests that a price parameter
may originally have been used by the application, perhaps for testing purposes
during development. This parameter would have been submitted to the server
and may have been processed by the application. In this situation, you should
definitely test whether the server-side application still processes this parameter.
If it does, seek to exploit this fact.
TRY IT!
http://mdsec.net/shop/104/
HACK STEPS
1. Look for disabled elements within each form of the application. Whenever
you find one, try submitting it to the server along with the form’s other
parameters to determine whether it has any effect.
2. Often, submit elements are flagged as disabled so that buttons appear
as grayed out in contexts when the relevant action is unavailable. You
should always try to submit the names of these elements to determine
whether the application performs a server-side check before attempting
to carry out the requested action.