The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 11 

■

Attacking Application Logic  351

70779c11.qxd:WileyRed  9/14/07  3:14 PM  Page 351

---

The Attack

Once the assumption has been explicitly stated in this way, the logic flaw

becomes obvious. Of course, an ordinary user can issue a request that does not

contain an existing password parameter, because users control every aspect of

the requests they issue.

This logic flaw was devastating for the application. It enabled an attacker to

reset the password of any other user and so take full control of their account.

HACK STEPS

■

When probing key functionality for logic flaws, try removing in turn each

parameter submitted in requests, including cookies, query string fields,

and items of 

POST

data.

■