The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 10 

■

Exploiting Path Traversal

347

70779c10.qxd:WileyRed  9/14/07  3:14 PM  Page 347

---

70779c10.qxd:WileyRed  9/14/07  3:14 PM  Page 348

---

349

Attacking Application Logic

C H A P T E R

11

All web applications employ logic in order to deliver their functionality. Writ-

ing code in a programming language involves at its root nothing more than

breaking down a complex process into very simple and discrete logical steps.

Translating a piece of functionality that is meaningful to human beings into 

a sequence of small operations that can be executed by a computer involves a

great deal of skill and discretion. Doing it in an elegant and secure fashion is

even harder still. When large numbers of different designers and program-

mers work in parallel on the same application, there is ample opportunity for

mistakes to occur.

In all but the very simplest of web applications, a vast amount of logic is

performed at every stage. This logic presents an intricate attack surface that 

is always present but often overlooked. Many code reviews and penetration

tests focus exclusively on the common “headline” vulnerabilities like SQL

injection and cross-site scripting, because these have an easily recognizable

signature and well-researched exploitation vector. By contrast, flaws in an

application’s logic are harder to characterize: each instance may appear to be a

unique one-off occurrence, and they are not usually identified by any auto-

mated vulnerability scanners. As a result, they are not generally as well appre-

ciated or understood, and they are therefore of great interest to an attacker.

In this chapter, we will describe the kinds of logic flaws that often exist in web

applications and the practical steps that you can take to probe and attack an

application’s logic. We will present a series of real-world examples, each of which

70779c11.qxd:WileyRed  9/14/07  3:14 PM  Page 349

---

manifests a different kind of logical defect and which together serve to illustrate

the variety of assumptions made by designers and developers that can lead

directly to faulty logic, and expose an application to security vulnerabilities.