The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

The technique for finding and exploiting flaws of this kind is known as 

forced

browsing

. This involves circumventing any controls imposed by in-browser

navigation on the sequence in which application functions may be accessed:

■

When a multistage process involves a defined sequence of requests,

attempt to submit these requests out of the expected sequence. Try skip-

ping certain stages altogether, accessing a single stage more than once,

and accessing earlier stages after later ones.

■

The sequence of stages may be accessed via a series of 

GET

or 

POST

requests for distinct URLs, or they may involve submitting different sets

of parameters to the same URL. The stage being requested may be speci-