the-web-application-hackers-handbook

418 Chapter 11 n Attacking Application Logic
Example 7: Cheating on Bulk Discounts
The authors encountered this logic flaw in the retail application of a software
vendor.
The Functionality
The application allowed users to order software products and qualify for bulk
discounts if a suitable bundle of items was purchased. For example, users who
purchased an antivirus solution, personal firewall, and antispam software were
entitled to a 25% discount on the individual prices.
The Assumption
When a user added an item of software to his shopping basket, the application
used various rules to determine whether the bundle of purchases he had chosen
entitled him to a discount. If so, the prices of the relevant items within the shopping
basket were adjusted in line with the discount. The developers assumed
that the user would go on to purchase the chosen bundle and therefore would
be entitled to the discount.
The Attack
The developers’ assumption is rather obviously flawed because it ignores the
fact that users may remove items from their shopping baskets after they have
been added. A crafty user could add to his basket large quantities of every
single product on sale from the vendor to attract the maximum possible bulk
discounts. After the discounts were applied to items in his shopping basket, he
could remove items he did not want and still receive the discounts applied to
the remaining products.
HACK STEPS
1. In any situation where prices or other sensitive values are adjusted based
on criteria that are determined by user-controllable data or actions, first
understand the algorithms that the application uses and the point within
its logic where adjustments are made. Identify whether these adjustments
are made on a one-time basis or whether they are revised in response to
further actions performed by the user.
2. Think imaginatively. Try to find a way of manipulating the application’s
behavior to cause it to get into a state where the adjustments it has
applied do not correspond to the original criteria intended by its designers.
In the most obvious case, as just described, this may simply involve
removing items from a shopping cart after a discount has been applied!