the-web-application-hackers-handbook

844 Chapter 21 n A Web Application Hacker’s Methodology
9.4 Test Trust Boundaries
9.4.1 Probe how the application handles transitions between different types
of trust of the user. Look for functionality where a user with a given
trust status can accumulate an amount of state relating to his identity.
For example, an anonymous user could provide personal information
during self-registration, or proceed through part of an account recovery
process designed to establish his identity.
9.4.2 Try to find ways to make improper transitions across trust boundaries
by accumulating relevant state in one area and then switching to a
different area in a way that would not normally occur. For example,
having completed part of an account recovery process, attempt to
switch to an authenticated user-specific page. Test whether the application
assigns you an inappropriate level of trust when you transition
in this way.
9.4.3 Try to determine whether you can harness any higher-privileged function
directly or indirectly to access or infer information.
9.5 Test Transaction Logic
9.5.1 In cases where the application imposes transaction limits, test the
effects of submitting negative values. If these are accepted, it may be
possible to beat the limits by making large transactions in the opposite
direction.
9.5.2 Examine whether you can use a series of successive transactions to bring
about a state that you can exploit for a useful purpose. For example, you
may be able to perform several low-value transfers between accounts
to accrue a large balance that the application’s logic was intended to
prevent.
9.5.3 If the application adjusts prices or other sensitive values based on criteria
that are determined by user-controllable data or actions, first understand
the algorithms used by the application, and the point within its logic
where adjustments are made. Identify whether these adjustments are
made on a one-time basis, or whether they are revised in response to
further actions performed by the user.
9.5.4 Try to find ways to manipulate the application’s behavior to cause it to
get into a state where the adjustments it has applied do not correspond
to the original criteria intended by its designers.