The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

of user can update or perform other actions on a common collection of

data, you should walk through the process using each type of user and

observe the parameters submitted. Where different parameters are ordi-

narily submitted by the different users, take each parameter submitted

by one user and try to submit this as the other user. If the parameter is

accepted and processed as that user, explore the implications of this

behavior as previously described.

Example 4: Breaking the Bank

The authors encountered this logic flaw in the web application deployed by a

major financial services company.

The Functionality

The application enabled existing customers who did not already use the online

application to register to do so. New users were required to supply some basic

personal information, to provide a degree of assurance of their identity. This

information included name, address, and date of birth, but did not include

anything secret such as an existing password or PIN number.

When this information had been correctly entered, the application for-

warded the registration request to back-end systems for processing. An infor-

mation pack was mailed to the user’s registered home address. This pack

included instructions for activating their online access via a telephone call to

the company’s call center and also a one-time password to use when first log-

ging in to the application.