The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

106

Chapter 5 

■

Bypassing Client-Side Controls

70779c05.qxd:WileyRed  9/16/07  5:14 PM  Page 106

---

Here, the browser will prevent the user from entering any more than three

characters into the input field, and so the server-side application may assume

that the quantity parameter it receives will be no longer than this. However,

the restriction can be easily circumvented either by intercepting the request

containing the form submission to enter an arbitrary value, or by intercepting

the response containing the form to remove the 

maxlength

attribute.