the-web-application-hackers-handbook

842 Chapter 21 n A Web Application Hacker’s Methodology
9 Test for Logic Flaws
9.1. Identify key attack surface
9.2.
Multistage
processes
9.3.
Incomplete
input
9.4.
Trust
boundaries
9.5.
Transaction
logic
Figure 21-10: Testing for logic flaws
9.1 Identify the Key Attack Surface
9.1.1 Logic flaws can take a huge variety of forms and exist within any aspect
of the application’s functionality. To ensure that probing for logic flaws
is feasible, you should first narrow down the attack surface to a reasonable
area for manual testing.
9.1.2 Review the results of your application mapping exercises, and identify
any instances of the following features:
n Multistage processes
n Critical security functions, such as login
n Transitions across trust boundaries (for example, moving from being
anonymous to being self-registered to being logged in)
n Context-based functionality presented to a user
n Checks and adjustments made to transaction prices or quantities
9.2 Test Multistage Processes
9.2.1 When a multistage process involves a defined sequence of requests,
attempt to submit these requests out of the expected sequence. Try
skipping certain stages, accessing a single stage more than once, and
accessing earlier stages after later ones.
9.2.2 The sequence of stages may be accessed via a series of GET or POST
requests for distinct URLs, or they may involve submitting different
sets of parameters to the same URL. You may specify the stage being