the-web-application-hackers-handbook

410 Chapter 11 n Attacking Application Logic
This logic flaw was devastating for the application. It enabled an attacker to
reset the password of any other user and take full control of that person’s account.
HACK STEPS
1. When probing key functionality for logic flaws, try removing in turn each
parameter submitted in requests, including cookies, query string fields,
and items of POST data.
2. Be sure to delete the actual name of the parameter as well as its value.
Do not just submit an empty string, because typically the server handles
this differently.
3. Attack only one parameter at a time to ensure that all relevant code paths
within the application are reached.
4. If the request you are manipulating is part of a multistage process, follow
the process through to completion, because some later logic may process
data that was supplied in earlier steps and stored within the session.
Example 3: Proceeding to Checkout
The authors encountered this logic flaw in the web application employed by
an online retailer.
The Functionality
The process of placing an order involved the following stages:
1. Browse the product catalog, and add items to the shopping basket.
2. Return to the shopping basket, and finalize the order.
3. Enter payment information.
4. Enter delivery information.
The Assumption
The developers assumed that users would always access the stages in the intended
sequence, because this was the order in which the stages are delivered to the
user by the navigational links and forms presented to the user’s browser. Hence,
any user who completed the ordering process must have submitted satisfactory
payment details along the way.
The Attack
The developers’ assumption was flawed for fairly obvious reasons. Users controlled
every request they made to the application and therefore could access